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PREFACE 


The  concept  of  the  factors  of  structural  safety  presently  applied ‘to  the  design  of  fixed- 
wing  aircraft  can  be  traced  back  some  50  years.  The  numerical  values  of  these  factors  are 
based  on  experience  hidden  away  in  history,  and  literature  and  requirements  only  give-indica- 
tions of  the  various  aspects  which  th6  factors  are  intended  to  cover,  thus  showing  a lack  of 
rational  definition. 

The  last  decades  have  brouglit  about  rapid  progress  in  establishing  aerodynamic 
derivatives,  defining  load  conditions  and  predicting  structural  loads  as  well  as  enabling  more 
detailed  analyses  for  stress  and  deformation  to  be  made. 

The  lack  of  a rational  basis  for  the  factors  of  safety  together  with  the  progress  made 
brought  about  a discussion  of  changing  the  concept  and  the  factors  involved.  AGARD 
Structural  and  Materials  Panel  formed  an  ad  hoc  Group  to  condense  this  discussion. 

Tlie  three  pilot  papers  contained  in  this  report  address  the  different  aspects  which  are 
envisaged,  and  show  up  inconsistencies  of  the  present  concept  as  well  as  means  and  methods 
for  possible  changes  and  examples  of  the  outcome.  An  additional  paper  summarizes  what  is 
going  on  in  the  field  of  civil  engineering  with  respect  to  structural  safety. 

It  is  hoped  that  these  papers  will  rise  to  a concerted.effort  towards  rationalizing  the 
concept  of  structural  safety  in  aircraft  design. 


R.J.MI1YER-JENS 
Chairman,  Ad  Hoc  Group 
on  Factors  of  Safety 
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SUMMARY 

It  is  the  philosophy  o£  the  present  airworthiness  regulations  for  airplane  design 
to  define  the  expected  loads  during  operation  in  terms  of  limit  loads.  The  required 
margin  oj  safety  between  these  limit  loads  and  the  ultimate  loads  has  until  now  been 
covered  by  a factor  of  safety  of  1.5.  The  proposal  is  made  to  rethink  the  philosophy 
of  having  a fixed  factor  of  safety,  taking  into  account  the  probability  of  load 
occurrences  and  variations  in  the  properties  of  materials.  The  load  level  of  limited 
loads  or  of  extremely  rare  occurrences  could  then  be  defined  as  maximum  loads  with 
a lower  factor  of  safety.  Three  possible  methods  of  predicting  maximum  loads  are 
proposed. 


1 .0  INTRODUCTION 

The  present-day  safety  factor  for  aircraft  structures,  as  applied  to  manned  aircraft, 
dates  back  50  years.  During  this  period  considerable  progress  has  been  made,  expecially 
in  the  fields  of  structural  materials,  semifinished  products,  and  testing  methods. 
Furthermore  advances  in  aerodynamics  and  aeroelasticity,  combined  with  developments 
in  electronic  data  processing  (EDP) , facilitate  a better  prediction  of  structural  -loads. 

A reappraisal  of  the  safety  factor  :-x>uld  therefore  seem  to  be  in  order,  not  with 
the  intention  of  lowering  the  level  of  safety,  but  with  the  aim  of  examining  the  various 
safety  requirements  in  the  light  of  present  knowledge.  In  this  connection  design  loads 
should  be  defined  as  those  loads  that  will  be  exceeded  only  with  a small  probability. 

They  are  then  called  maximum  loads.  At  present  possibilities  for  the  application  of 
this  view  are  visualized  mainly  for  military  aircraft,  and  three  possible  methods  are 
recommended : 

- semt-statistical/semi-deterministic 

- statistical:  Extreme-value  distribution 

- semi-statistical/semi-eropirical 

2.0  LIMIT  LOAD  CONCEPT 

2.1  Historical  Review 

Since  the  early  days  of  aviation  all  countries  engaged  in  aircraft  construtlon 
have  been  concerned  with  safety  in  aircraft  design.  Safety  factors  were  introduced  into 
the  design  of  the  structure  to  take  care  of  uncertainties  which  could  not  be  properly 
assessed  by  the  technological  means  of  that  time,  such  as 

a)  the  possible  occurrence  of  load  levels  higher  than  the  limit  load 

b)  uncertainties  in  the  theoretical  or  experimental  determination  of  stresses 

c)  scatter  in  the  properties  of  structural  materials,  and  inaccuracies  in 
workmanship  and  production 

c)  deterioration  of  the  strenght  of  materials  during  the  operational  life 
of  the  aircraft 

Figure  1 shows  the  development  of  the  safety  -factor  as  required  by  American,  British, 
French,  and  earlier  German  regulations.  In  comparing  American  and  German  regulations 
it  should  be  kept  in  mind  that  limit  loads  were  defined  differently,  so  that  the  American 
specification  CAR  yields  higher  ultimate  loads,  although  the  corresponding  safety  factor 
is  smaller,  e.g.,  since 

n^  ■»  j x nj^  for  large  gross  weights 

n^  “ 1.5  X 2.5  * 3.75  for  CAR 

n «■  1.8  X 2.0  - 3.60  for  BVF 

\U 


TABLE  1 SAFETY  FACTORS  OF  SEVERAL  REGULATIONS 


The  corresponding  values  for  the  yield  safety  factor,  or  factor  of  proof  test,  jp,  , 
for  the  various  countries  is  also  shovm  in  Tabl^  1 . The  ratio  jp/jp  is  given  as  about^l .5 
by  currently  valid  American  and  British  specifications,  with  the  exception  of  the  British- 
military  specification  Av.P.  970.  It  distinguishes  two  groups  (Reference  6) 

a)  cases  for  which  the  load  level  is  not  limited  by  the  capabilities  of  the 
aircraft  but  is  defined  on  the  basis  of  experience,  with  safety  factors 
as- listed  in  Table  1 

b)  cases  where  the  aircraft  is  incapable  of  producing  operational  loads  in 
excess  of  prescribed  load  levels,  or  where  operational  loads  are  limited 
by  reliable  means.  For  these  cases  an  ultimate  factor  jy  is  not  defined. 


The  French  military  specifications  AIR  2004/D  (Reference  4)  require  various  ultimate 
factors.  For  ground  loads  the  factor  jy  decreases  to  1.3  for  the  undercarriage  and  its 
support  structure.  For  flight  loads  the  ultimate  factor  depends  on  the  category  of  air- 
craft, l.e.  on  the  maneuver  load  factor.  In  addition  to  this  the  concept  of  frequent  loads 
(charges  sSres,  or  charges  de  base)  has  been  Introduced  into  the  AlR  2004/0  Regulation. 
They  are  defined  as  the  maximum  loads  occurring  during  normal  operation,  and  differ  from 
limit  loads  by  a factor  of  l'.  This  factor  depends  al^p  on  the  aircraft  category.  Pig.  2 
shows  the  safety  factors  according  to  AIR  2004/0  in  relation  to  limit  load.  Beyond  this 
limit,  loads  are  required  not  to  cause  permanent  deformations  larger  than  5 % of  defor- 
mations under  this  load. 

The  ratio  of  ultimate  stress  to  yield  stress  has  deorpased  continuously  with  the 
increasing  use  of  high-strength  materials,  so  that  currently  its  value  ranges  between 
1.1  and*  1.5,  Pig.  3 shows  t)w  vtrend  of  the  last  four  decades.  It  is  interesting  to  note 
that  the  ulti.T.ata  f5:c-ior  of  Safety  was  defined  in  1534/  when  the  aluminum  alloy  2024  with 
approximately  the  same  ratio  of  ultWate  ':o  yield  strength  had  generally  come  into  use  in 
aircraft  construction. 
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Fig.  4 shows  the  dependence  of  ultimate  strength/yield  strength  on  ultimate  tensile 
strength  of  some  structural  materials  used  today  in  aircraft  construction  at  room 
temperature.  Fig.  5 shows  the  dependence  of  this  ratio  on  temperature.  These  figures  show 
that  the  high-strength  aluminum  alloys,  high  heat  treat  steels  and  titanium  alloys  in 
current  use  have  a considerably  smaller  ratio  of  ultimate  to  yield  strength  than  1.5.  It 
should  however  be  kept  in  mind  that  within  certain  groups  of  materials  toughness  decreases 
with  Increasing  yield  strength,  an  aspect  which  is  important  in  fracture  mechanics  con- 
sideration. 

2.2  Inconsistencies  and  Deviations 


It  can  be  said  that  ia  general  the  present-day  safety  factor  is  a more  or  less 
arbitrary  factor  which  is  multiplied  with  the  limit  load  or  the  load  factor  in  order  to 
make  sure  that  prescribed  loads  may  be  exceeded  by  a certain  amount  before  failure  of  the 
structure  occurs.  In  general  the  safety  factor  also  provides  for  enough  strength  to  avoid 
permanent  deformations  due  to  occurring  loads.  Limit  loads,  however,  are  defined  indepen- 
dently of  the  probability  of  their  occurrence,  i.e.  safety  margins  differ  according  to  the 
type  of  loading  and  structural  component.  Some  examples  follow: 

Limited  Loads  - For  these  in-flight  loads  which  are  either  limited  by  the  capability 
of  the  aircraft  or  by  reliable  means,  the  same  safety  factor  is  applied  as  for  those  whose 
maximum  values  are  not  limited,  or  aannot  be  determined  within  close  tolerances.  Limited 
loads  are,  for  Instance ,- 

- loads  caused  by  Internal  pressure  (cabin) 

- loads  caused  by  control  surfaces  with  limited  deflections 

- thrust  loads  of  engines  or  rockets 

- loads  caused  by  negative  gauge  pressures  near  absolute  vacuum 

- the  occurring  load  does  not  have  the  same  safety  factor  as  the  main  load 
parameter,  as  for  instance,  in  the  case  of  up  and' down  gusts  (Fig.  6): 


(1.)  Safety  factor 
associated  with 
load  factor 
n j “ j (If  A n) 
up:  - 1.5  (1+2)  - + 4.5 
down:  “ 1.5  (1-2)  “ - 1.5 


(2)  Safety  factor 
associated  with 
additional  load  factor 
hxj“1+j  An 
up:  - 1 + 1.5  X 2 - + 4.0 
down:  "I  -1.5x2»'  - 2.0 


I 


i 


\ 


1 
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n-  j = j( ) ♦ An ) 
n-  j i 1 ♦ j - An 
n-  j = js(  1.0*  An) 
js  = 1.2  jL=l-25 

A^=i[  jL(1.0+An,„)-1.0] 

>^•1  = js  {l.0*[jLl1.0+An„,)-1.0]J 


SAFETY 


In  the  first  case  the  safety  factor  is  applied  to  the  total  load,  and  yields  a ultimate 
load  for  the  “dovm-case"  lower  than  that  for  a gust  velocity  1.5  times  larger.  In  the 
second  case  the  additional  load  factor  is  factored  out  of  the  gust  effect,  producing 
a value  for  the  "up  case"  lower  than  that  when  total  loads  are  considered. 

The  Dutch  aviation  agency  RLD  have  stipulated  a special  requirement  for  the 
structural  design  of  a single  aircraft  type.  It  raises  the  ultimate  negative  gust  load 
factor,  as  is  defined  in  FAR  25,  by  An  ^ - 0.6.  This  requirement  is  derived  with  the 
assumption  that  the  safety  factor  is  split  into  two  parts,  one  for  uncertainties  in  the 
load,  the  other  for  uncertainties  in  the  strength  of  the  material, 

j >•  X jg  ••  1.25  X 1.2  = 1.5  . 

With  this  requirement  the  ultimate  negative  gust  load  factor  becomes  n x j = 2.1 
in  the  preceding  example,  i.e.  somewhat  larger  than  in  case  2.  Fig.  6 shows  the  compari- 
son of  the  two  cases,  and  the  RLD  requirement,  presented  as  case  3. 

2.3  Development  of  Computation  and  Test  Methods 

In  the  last  three  decades  theoretical  and  experimental  methods  of  aerodynamics  have 
been  developed  considerably  so  that  the  prediction  of  aerodynamic  forces  on  structures 
and  their  distribution  is  more  accurate  than  in  the  past.  Virtually  all  types  of  in-flight 
and  ground  loads  can  be  determined  today  with  the  aid  of  EDP.  Calculations  also  can  include 
the  effects  of  non-linearities  and  control  elements  (actuators,  dampers,  CSAS,  etc.).  Fig.  7 
shows  the  influence  of  control  components  (actuators  and  CSAS)  for  a modern  fighter  during 
a rolling  maneuver.  In  the  past,  calculations  of  longitudinal  and  lateral  motions  were 
decoupled  to  a large  extent  because  of  the  large  computational  effort  involved.  Today 
calculations  with  five  of  six  rigid-body  degrees  of  freedom  are  quite  common. 

While  in  the  past,  undercarriage  loads  were  determined  for  each  undercarriage  separa- 
tely by  associating  it  with  an  equivalent  mass  ( unit  load) , it  is  today  possible  to  cal- 
culate the  landing  Impact  dynamically  as  a whole.  Although  aeroelastlc  problems  have  in- 
creased with  increasing  flight  speed  and  aircraft  complexity,  the  capability  to  cope  with 
them  has,  on  the  whole.  Increased  at  the  same  rate.  Here,  too,  the  availability  of  compu- 
ters helped  to  Increase  the  number  of  degrees  of  freedom  which  are  used  to  describe  the 
dynamic  oehaviot.  of  the  aircraft.  In  the  field  of  statics  and  strength  of  materials  much 
more  detailed  stress  calculations  can  and  are  made  thanks  to  matrix  methods,  expecially  the 
finite-element  method,  .’tdvances  in  experimental  techniques  concerning  measuremen'es  and  the 
application  of  loads  to  structures  also  provide  a considerably  more  detailed  check  on  cal- 
culations by  static  and  fatigue  tests. 
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Furthermore  flight  testing  today  is  in  the  position  of  being  able  to  supply 
a multitude  of  data  because  of  improvements  in  the  collection,  transmission  and  processing 
of  experimental  data.  It  is,  for  Instance,  common  practice  to  measure  sectional  forces 
according  to  MIL-Spec.  8871  at  various  stations  of  the  structure  in  flight  (several  wing 
cross-sections,  at  least  one  empennage  section,  and  one  fuselage  section) . Any  significant 
discrepancies  in  the  measured  and  the  predicted  values  are  then  taken  into  account  in  the 
design  of  production  aircraft.  A better  knowledge  of  material  properties  under  various 
conditions  (environment) , and  the  ability  to  "'test  materials  and  structures  non-destructively 
(X-ray,  ultrasonic  methods,  etc.)  makes  a comprehensive  and  thorough  quality  control 
possible,  beginning  with  the  manufacture  of  materials  and  semi-finished  products,  and 
ending  with  the  final  check  of  the  operational  aircraft.  t* 

3.0  MAXIMUM  LOAD  CONCEPT 

3 . 1 Basic  Ideas 

For  the  past  20  years  the  question  has  been  raised  by  structural  experts  of  various 
institutions,  whether  the  rather  rigid  safety  factor  of  1.5  is  still  realistic  today.  This 
has  been  documented  in  numerous  publications  (see  P.eferences) . One  of  the  alternatives  to  the 
1.5  safety  factor  that  has  been  proposed  is  the  maximum  load  concept.  The  basic  ideas  of 
this  concept  were  developed  by  VI.  Braun  (Reference  11)and  J.  v.  Osnabrugge  and  N.  Schipper 
(Reference  12).  The  term  Maximum  Load  Concept  was,  however,  coined  later  by  Aldinio  and  s 

Tagliaferrl  (Reference  13) . 

The  main  idea-  of  the  maximum  load  concept  is  to  split  the  proven  safety  factor  of 
1.5  into  two  parts  in  a rational  fashion,  one  for  the  uncertainties  in  the  loading  (deter-  ! 

mlnation  of  loads,  static  calculations),  the  other  for  uncertainties  in  strength  (scatter  j 

of  material  properties  and  inaccuracies  in  construction) . Allowable  loads  are  defined  as  I 

those  load  values  that  will  only  be  exceeded  by  expected  loads  with  a prescribed  small  j 

probability.  These  .loads  are  then  referred  to  as  maxlmiun  lo.ads.  I 

I 

The  Airworthiness  Commitee  of  the  International  C','v<l  Aviati,on  Organization  (ICAO) 
discussed,  among  other  things,  the  subject  of  maximum  load  concept  in  the  period  from 
1957  to  1970. It  was  decided  in  Montreal  in  late  1970  not  to  pursue  this  concept  for  the 
time  being  as  a possible  basi.s  for  airworthiness  regulations.  Several  proposals  however, 
were  made  to  improve  structural  safety.  This  subject  was  also  discussed  by  tha  Study  Group 
Structures  of  the  AECMA  (Association  Europlenne  des  Constructours  de  Material  Aerospatial) 
in  the  context  of  the  Joint  Airworthiness  Requirement  (JAR) . These  deliberations  leu  to  the 
suggestion  to  split  the  safety  factor  into  the  previously  mentioned  two  parts,  and  to 
consider  load  limits  as  maximum  loads.  ' 

I 
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Gust  or  landing  loads  are  strongly  Influenced  by  random  physical  or  human 
characteristics.  But  also  in  these  cases  safety  could  be  much  better  defined  by 
extrapolating  loads  from  statistical  data,  rather  than  the  application  of  a safety 
factor  of  1.5  for  all  cases.  Loads,  furthermore,  that  are  limited  naturally  by  the 
ability  of  the  aircraft  to  produce  them,  or  by  internal  aircraft  systems,  could  be 
regarded  as  maximum  loads  to  which  a safety  factor  need  not  be  applied.  The  deter- 
mination of  maxi.7.um  loads  with  a small  probability  of  being  exceeded  is-  entirely 
possible  for  modern  fighters  which  are  limited  in  their  maneuvers,  or  for  control  con- 
figured vehicles  (CCV)  which  are  in  any  case  equipped  with  a fly-by-wire  flight  control 
system. 

As  a principle  the  prescribed  design  boundaries  and  the  corresponding  safety  factor 
should  not  be  separated,  i.e.  the  entire  design  philosophy  should  be  considered.  There- 
fore a mixed  application  of  various  regulations  to  a single  project  is  not  advisable. 

Up  to  now  the  safety  factor  has  been  reduced  in  only  a few  cases.  Within  the  pertinent 
regulations  only  the  case  of  the  American  MIL-Spec.  1960  issue  is  known,  where  no  safety 
margin  is  required  for  the  undercarriage  and  its  supporting  structure.  It  may  be  supposed 
that  with  the  consent  of  the  appropriate  authorities  the  safety  factor  or  the  load  level 
could  be  reduced  in  the  following  cases.*. 

- in  emergencies,  such  as  emergency  landings  into  an 
arresting  net  or  cable 

- for  transient  phenomena  (hammer  shock  pressures  in  aircraft  Inlets) 

- where  actuators  are  power-limited  and  large  loads  cannot  be  produced 
3,2  Suggested  Models 

The  following  models  are  proposed  for  the  application  of  the  maximum  load  concept: 

3.2.1  Semi-statistical/semi-deterministic 

In  the  past  operational  loads  were  predominantly  checked  by  measurement  of  the  main 
load  parameters,  in  the  form  of  cumulative  frequencies  or  load  spectra  (Reference  14). 

They  are: 

- the  normal  load  factor,  in  flight  and  on  the  ground 

- the  angle  of  sideslip  and/or  the  transverse  load  factor 

- the  rolling  velocity  in  flight 

- the  bank  angle  during  landing. 

On  the  basis  of  these  load  spectra  a probability  of  occurence  of  the  main  load  parameters 
is  defined  for  each  type  of  mission  and  maneuver,  and  the  maximum  value  of  the  main  load 
parameter  can  be  determined  from  this. 

If,  for  Instance,  an  aircraft  is  designed  for  air-to-air  combat,  a maximum  load 
factor  of  9.0  may  be  derived  from  the  statistical  cumulative  frequency  distribution  for 
every  tenth  aircraft  after  40(X)  flight  hours.  This  value  is  taken  to  be  the  maximum  main 
load  parameter.  Tor  this  load  parameter  the  loads  produced  by  the  maneuvers  specified  in 
the  pertinent  regulations  are  determined  by  means  of  a deterministic  calculation  such 
that  the  maximum  value  of  the  main  load  parameter  is  just  attained,  but  not  exceeded.  An 
example  is  the  loads  as  a function  of  time  produced  by  the  actuation  of  cockpit  controls 
according  to  MIL-8861 . 

3.2.2  Statistical:  Extreme  value  distribution 

As  a rule,  load  spectra  are  produced  with  the  objective  of  determining  magnitude 
and  frequency  of  operational  loads.  These,  in  turn,  are  used  in  vibration  tests  to 
determine  the  corresponding  fatigue  life  of  the  structure.  Load  spectra  like  these  are 
derived  from  relatively  short  time  records,  compared  to  the  actual  operational  life  time; 
they  do  not  contain  those  maximum  values  that  might  be  expected  to  occur  during  the  entire 
operational  life  of  the  structure,  i.e.  a knowledge  of  which  is  necessary  for  the  design. 

In  1967,  0.  Buxbaum,  of  LBF,  suggested  a method  to  determine  design  loads  from  extreme 
values  of  frequency  distributions  (Reference  15).  This  method  is  capable  of  deriving  design 
loads  by  means  of  the  statistical  evaluation  of  the  extreme  values,  in  cases  where  the 
range,  the  maximum  value,  and  the  scatter  of  the  spectrum  may  be  safely  assumed.  The  design 
load  determined  in  this  way  is  described  by  its  magnitude  and  its  probability  of  exceedance. 

As  an  example  the  maximum  rolling  moment  at  the  horizontal  tall  of  the  Transall  Cl  60 
was  determined  in  this  way  by  means  of  in-flight  measure.ments.  The  design  load  was  taken 
to  be  that  maximum  value  of  the  extreme  value  distribution  expected  to  occur  once  for 
every  tenth  aircraft.  Figure  8 shows  the  extreme  value  distribution  for  the  rolling  moment 
at  the  horizontal  tall  for  53  flights.  The  design  load  case  with  10  % for  1250  flights 
is  also  shown  there,  i.e.  this  rolling  moment  is  expected  to  occur  once  for  every  tenth 
aircraft  within_1250  flights.  For  purposes  of  information  the  values  for  an  exceedance 
probability  of  Wq  « 50  » (every  second  aircraft)  and  Wq  ■■  90  % (almost  every  aircraft) 
are  also  shown. 
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FIG. 8 EXTREME  - VALUE  DISTRIBUTION 


Th«  horiiontal  tail  of  tha  Cl  60  was  first  dasignod  according  to  tha  prascribad 
French  AIR  2004/D  apacif ication, It  requires  for  the.  asysseatric  loading,  of  tha  horisontal 
tail  to  assune  - 

- 100  % of  tha  naxinuB  load  for  syssMtric  flight  cases  on  qno  side  of  tha 
plana  of  syanatry>  and  75  % of  this  load  on  tha  other  side; 

- in  tha  vicinity  of  stalli  100  I of  the  naxinua  load  on  one  side  and  SO  % on 
tha  other  side. 

The  aagnituda  of  tha  rolling  Boowht  at  tha  horisontal  tall,  is  about  twice  the  axwent 
derived  frost  AIR  2G04/0. 


FIG.9  EXTREME  - VALUE  -DISTRIBUTION  VERTICAL 
ACCELLERATION  ON  TAIL 


In  rig.  9 a furthar  exanpl*  of  tli«  oxtramo  valua  dlatrlbution  is  showit  i.a., 
a vartlcal  accalaration  on  ttia  roar  fusalaga  of  tho  Cl 60  naasurad  in  24  ground  runs. 

This  distribution  claarl/  shows  tha  rango  for  naxinum  angina  spaod,  l.o.,  tha  rango 
whara  almost  lio  riso  in  axtrama  valuas  can  ba  datactod  for  docraasing  probability 
of  occurrohca.  Undor  absolutaly  aqual  ground  riui  conditions  tha  axtrono  valuas  should 
ba  indapandant  of  tha  probability  Wq,  i.a. , thay  could  ba  takan  as  lialtad  loads. 

3.3.3  saal-statistlcal/sanl'-anpirical 

It  has  baan  knotm  for  scsm  yaars  that  VG  and  VGH  maasurosiantt  do  not  suffica  for 
tha  daflnltion  of  crltaria  for  structural  dasign.  In  ordor  to  obtain  statistically 
supported  dasign  crltarla>  a spaolal  NACA  Sub-Comittaa  on  Aircraft.  Loads  raccanandad 
in  1954  to  axp^  statistical  load  prograaw  to  tha  axtant  that  thay  includad  maasuramants 
of  time  hlatbri’as  of  sight  paramatars  (thraa  linear  accalsratlons,  three  angular 
aocalarations,  airspeed  and  altitude) . The  first  measuraments  of  this  kind  were  made  with 
the  F 105  0 Fighter  in  i^ce  time  with  the  aim  to  develop  a maneuver  load  concept  which 
was  to  predict  dasign  leads  for  tha  fuselage,  wing,  horisontal  ita'll,  and  vertical  tall 
(Rafaranca  16).  All  data  were  ptoeessed  to  calculate  time  histories  etf  loads,  with  peaks 
called  "observed  loads*.  The  data  oscillograms,  wore  examined  in  order  to  define  23 
recognisable  types  of  maneuver. 


II 


Assuming  that  for  every  type  of  maneuver  the  same  sequence  of  aircraft  motion 
occurs  with  the  exception  of  differences  in  eunplitude  and  duration,  the  measured  para- 
meters were  normalized  with  respect  to  amplitude  and  time.  Finally,  to  determine  the 
loads# the  normalized  parameters  were  denormalized  in  order  to  get  the  load  peak 
distribution  for  the  wing,  the  fuselage,  and  the  empennage.  The  good  agreement  between 
observed  and  predicted  load  peak  distribution  demonstrated  the  feasibility  of  the  maneuver 
model  technique  for  the  F-105  D aircraft. 

The  F-106  Fighter  was  selected  to  demonstrate  this  model  on  another  aircraft.  The 
detailed  results  of  3770  flight  test  hours  made  it  possible  to  apply  the  maneuver  model 
technique,  i.e.  the  empirical  calculation  of  component  loads  as  compared  to  the  F-106 
design  loads  (Reference  17) . The  results  in  the  form  of  cumulative  occurrence  of  the 
loads  for  wing,  elevon,  and  vertical  tail  made  it  possible  to  determine  the  design 
load  for  a given  cumulative  occurrence. 


FIG.  10  CUMULATIVE  OCCURRENCES  OF  VERTICAL 
STABILIZER  LOADS 


Fig.  10  shows  the  results  for  the  vertical  tail  as  published  by  General  Dynamics 
Corporation.  It  shows  how  the  maximum  load  for  structural  strength  considerations  may 
be  derived  from  the  plots  of  cumulative  occurrence.  Two  cases  are  shown  there.  One  is 
the  load  that  may  be  expected  to  occur  once  in  the  operational  life  of  every  aircraft, 
the  other  is  the  load  expected  for  every  fourth  aircraft. 
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3.3  Possibilities  of  Application 

A change  in  the  present  safety  factor  may  be  considered  appropriate,  with  due  regard 
to  durability  requirements  in  the  cases  of  - 

Limited  loads  - 


a)  loads  limited  by  aircraft  internal  systems,  such  as  cabin  pressure,  hydraulic 
pressure  etc. 

b)  loads  that  can  be  determined  with  sufficient  accuracy,  or  are  given  within 
narrow  tolerances  by  design  requirements,  such  as  engine  thrust,  engine  inlet 
pressures,  etc. 

c)  loads  that  are  Incapable  of  being  achieved  physically,  such  as  these  resulting 
from  negative  gauge  pressures  near  absolute  vacuum,  or  from  aerodynamic 
boundaries  (stall) . 

Loads  resulting  from  extreme  values  - Loads  -which  may  be  derived  with  sufficient 
accuracy  from  measured  extreme  values. 

Aircraft  with  load  alleviation  systems  - 

a)  loads  which  cannot  be  exceeded  in  practice  by  built  in  limiters, 
such  as  bob-weights,  shakers,  and  pushers  at  the  control  stick. 

b)  loads  that  have  been  determined  for  a flight  vehicle  with  automatic 
control  or  redundant  load  alleviation  systems  (maneuver  load  control, 
eSAS,  etc.) 

Double  failures  - Loads  that  have  been  determined  for  double  failures  where  an 
indication  of  the  failure  is  assured. 

4.0  CONCLUSION 

The  question  is  raised  whether  the  current  factor  of  safety  of  j = 1.5  still  makes 
sense  today.  The  aim  here  is  to  achieve  the  same  degree  of  safety  for  all  loading  con- 
ditions. One  way  to  this  objective  that  has  already  been  Indicated  by  structural  experts, 
is  to  replace  the  limit  load  concept  by  the  maximum  load  concept,  i.e.,  to  Introduce 
maximum  loads  with  a reduced  safety  factor  in  place  of  limit  loads  with  a safety  factor 
of  1.5.  The  main  criterion  for  the  design  of  combat  aircraft  is  given  by  the  maneuver 
loads.  These  are  capable  of  being  assessed  quite  accurately  at  the  present  time,  thanks 
to  the  lay  out  of  modern  combat  aircraft  on  one  hand,  and  to  improved  methods  of  pre- 
dicting loads  on  the  other  hand. 

Three  possible  methods  to  determine  maximum  loads  are  being  proposed: 

- semi-statist ical/semi-deterministic 

- statistical:  Extreme-value  distribution 

- semi  statistical/semi-empirical 

Which  of  the  methods  is  used  depends  on  the  design  philosophy  for  the  aircraft  in 
question,  and  to  what  extent  available  statistical  data  can  be  applied. 

At  the  present  time  the  life  time  of  an  aircraft  has  become  Increasingly  important 
in  aircraft  design.  The  weight  savings  due  to  the  application  of  the  maximum  load  concept 
therefore  should  hot  be  overlooked.  In  fact,  the  aim  here  should  be  to  detect  Inconsisten 
cies  within  the  current  concepts  and  to  indicate  ways  of  eliminating  them.  This  may  be 
accomplished  by  defining  and  determining  design  loads  individually  according  to  their 
mission  and  probability  of  occurence. 

In  the  field  of  materials  research  and  construction  methori?  some  efforts  have  been 
made  to  develop  materials  tailored  to  specific  applications  zcA  load  conditions,  and  to 
design  structures  to  take  full  advantage  of  new  materials.  The  question  is  whether  even 
larger  uncertainties  in  the  determination  of  loads  are  being  overlooked.  The  engineering 
means  of  determining  these  loads  exist,  but  the  integration  of  the  body  of  knowledge  and 
experience  in  predicting  loads  could  be  improved  by  more  systematic  studies. 

We  present  these  ideas  to  AGARO,  because  we  feel  that  if  some  of  these  arguments 
could  be  incorporated  in  future  recommendations,  AGARO  would  be  a suitable  institution 
to  make  these  recommendations  to  the  participating  nations.  The  working  methods  within 
AGARO  especially,  such  as  the  cooperation  of  the  various  panels  (e.g.  SMP  and  FOP) 
promise  to  help  attain  this  objective. 
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SUMMARY 


It  is  now  40  years  or  morel  since  the  factors  of  safety  for  fixed-wing  aircraft 
were  last  adjusted  in  the  UK,  USA  and  Germany,  and  it  is  considered  timely  to  roview 
them  again.  This  pilot  paper  looks  at  three  aspects  of  the  question  posed  by  the  title; 

a)  the  prima  facie  case 

b)  the  probabilistic  approach 

c)  the  potential  reduction  in  mass 

There  is  a strong  prima  facie  case,  and  predicted  mass  savings  for  both  combat  and 
transport  aircraft  lend  additional  support  to  the  argument. 

Data  is  needed  to  provide  a basis  for  a more  representative  study  of  the  probabilities 
of  failure;  research  into  this  aspect  would  be  very  worthwhile. 

1 INTRODUCTION 


A definition,  by  referring  to  basic  principles,  will  often  reveal  facets  of  a problem 
which  have  been  overlooked  in  the  ready  acceptance  of  subsequent  interpretations.  In 
seeking  a definition  of  the  factor  of  safety,  one  is  surprised  to  find  that  AvP970,  the 
British  handbook  of  Design  Requirements  for  Service  Aircraft2,  does  not  appear  to  give  a 
definition,  although  the  proof  factor  and  ultimate  factor  are  mentioned  in  Chapter  300, 
and  Leaflet  200/3  is  devoted  to  an  exposition  of  the  fundamental  principles  underlying 
the  choice  of  their  numerical  values. 

The  British  Civil  Airworthiness  Requirements  (BCAR)3  carry  a definition  in  Chapter 
01-2,  para  4.5: 

"Factors  of  Safety  (for  static  strength) 

Design  factors  (proof  and  ultimate)  to  provide  for  the  possibility  of  loads 
greater  than  those  expected  in  normal  conditions  of  operation,  uncertainties 
in  design  and  variations  of  structural  strength,  including  variation  of  strength 
resulting  from  deterioration  in  service". 

This  definition  is  interesting  in  that  it  gives  some  indication  of  the  various  aspects 
which  the  factor  is  intended  to  cover: 

Uncertainties  in  loads 
Inaccuracies  in  structural  analysis 
Variations  in  strength  properties  of  materials 
Deterioration  during  service  life 

To  this  list  might  be  added; 

Variations  in  build  standard  between  nominally  identical  components. 

An  oblique  reference  to  these  sources  of  variability  is  made  in  para  7 of  AvP970 
Leaflet  200/5,  which  states  that  due  allowance  must  be  made  for  them  if  the  specified 
factors  of  safety  are  to  be  regarded  as  adequate. 

In  considering  the  factors  of  safety,  therefore,  attention  must  be  given  to  the  five 
sources  of  variability  listed  above,  and  to  any  changes  in  variability  which  have  occurred 
during  the  past  40  years.  A study  of  these  five  sources  forms  the  basis  of  the  prima 
facie  case,  which  presents  an  argument  for  reducing  the  factor  of  safety.  The  effect  of 
such  a reduction  on  the  probability  of  failure  is  shown  in  the  next  section  of  the  paper, 
whilst  the  effect  on  operational  mass  is  given  in  the  later  sections. 


*EDIT0R'S  NOTE 


This  presentation  is  a compendium  of  four  papers,  suitably  edited,  which  were 
originally  written  for  the  Structures  Research  Sub  Committee  of  the  Society  of  British 
Aerospace  Companies. 
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THE  PRIHA  FACIE  CASE^ 


2, 1  Loads 


At  the  time  when  the  ultimate  factor  was  last  adjusted  (from  2.0  down  to  1.5,  circa 
1935) , no  flight  load  data  collection  had  been  made  to  substantiate  the  basis  for  the 
manoeuvres,  gust  encounters,  etc,  defined  in  the  requirements.  Aerodynamic  load 
distribution  diagrams  were  based  on  simple  lifting  surfaces  of  fixed  geometry,  and  no 
allowance  was  made  for  elastic  distortion  or  for  dynamic  effects. 

It  is  reasonable  to  assume  that  modern  load  prediction  methods,  coupled  with  a 
better  understanding  of  the  flight  envelope,  should  predict  applied  forces  to  a higher 
standard  of  accuracy  than  the  methods  of  yesteryear. 

2.2  Structural  Analysis 


Probably  the  greatest  change  in  the  design  process  during  the  past  20  years  has 
been  the  introduction  of  the  computer  for  structural  analysis.  The  earlier  analytical 
methods,  involving  over-simplification  of  the  structure  to  idealise  it  as  a system  of 
beams,  struts,  ties  and  shear  webs  which  were  amenable  to  mathamatical  treatment,  have 
been  largely  supplanted  by  finite  element  techniques  giving  a much  closer  approximation 
to  the  true  state  of  affairs.  The  computer  has  not  been  used  to  speed  up  the  old 
methods;  it  has  made  possible  a new  approach  to  structural  analysis,  and  this  fact  should 
be  recognised  when  reviewing  the  factors  of  safety. 

As  a counter-argvunent  it  should  be  noted,  however,  that  for  many  years  it  has  been 
the  practice  in  the  UK  and  elsewhere  to  confirm  the  structural  analysis  of  the  major 
airframe  components  by  means  of  a static  strength  test,  usually  ta)cen  to  destruction. 

Any  surplus  strength  has  usually  been  absorbed  by  developing  the  aircraft,  eg  by 
specifying  a greater  payload,  whilst  any  strength  deficiency  has  been  remedied  by  local 
modification. 

Since  this  practice  applies  whether  or  not  a refined  structural  analysis  has  been 
used,  the  final  outcane  is  the  same;  namely  that  the  major  components  of  the  aircraft 
have  a fairly  uniform  reserve  factor  as  near  as  possible  to  unity.  The  only  components 
not  proved  by  structural  testing  are  secondary  items  such  as  trailing  edges,  undercarriage 
doors  and  fairings  together  with  some  internal  structure  such  as  light  wing  ribs. 

2.3  Material  Properties 

Materials  for  aeronautical  use  have  always  been  subject  to  a strict  quality  control, 
and  it  is  doubtful  if  any  credit  can  be  claimed  for  improvements  in  this  area.  Moreover, 
the  introduction  of  B values  has  already  effectively  taken  account  of  a reduction  in  the 
factors  of  safety  in  certain  applications,  such  as  fail-safe  structures. 

2.4  Deterioration  during  Service  Life 

Structures  are  now  expected  to  survive  service  lives  far  in  excess  of  those 
anticipated  even  a fevr  years  ago.  Corrosion,  wear,  loosening  of  fasteners  and 
distortion  due  to  mishandling  must  all  be  cpnsldered,  and  none  of  these  sources  of 
deterioration  has  decreased  in  severity  over  the  years. 

However,  the  official  requirements  make  it  clear  that  the  ultimate  factor  is 
sometimes  set  at  a high  value  as  a safeguard  against  fatigue  (eg  BCAR,  where  for  pressure 
cabins  an  ultimate  factor  of  2.0  is  required  and  as  high  as  3.0  is  recommended).  This 
attitude  towards  fatigue  is  somewhat  outmoded,  and  it  would  be  more  in  keeping  with 
modern  philosophies  if  all  static  strength  calculations  were  based  on  a factor  of  safety 
which  excluded  fatigue  considerations.  The  reduction  of  working  stresses  to  ensure  the 
necessary  fatigue  resistance  is  nowadays  regarded  as  a separate,  but  nonetheless  Important, 
operation,  and  it  cannot  be  achieved  by  the  application  of  an  arbitrarily  inflated  factor 
applied  to  the  static  design  cases.  ! 

2.5  Build  Standard 

The  past  decade  has  seen  the  widespread  Introduction  of  numerically-controlled 
machines  for  the  production  of  wing  skins,  spars  and  ribs;  automatic  riveting  machines 
for  the  attachment  of  stringers;  close-to-£orm  forgings;  premium  quality  castings  and  a 
stricter  control  of  processes  of  all  kinds. 

These  Improvements  in  quality  have  led  to  a reduction  in  variability  between 
nominally  identical  components  which  should  be  reflected  in  a reduction  of  the  factors 
of  safety. 

2.6  Potential  Reductions 

Of  the  five  listed  sources  of  variability,  at  least  three  - 

Load  prediction 
Structural  analysis 
Build  standard 

have  shown  Improvement  over  the  past  25  years  or  so,  and  these  improvements  should  be 
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considered  when  reviewing  the  factors  of  safety. 

Two  sources  have  shown  no  Improvement  - 

Material  properties 

Deterioration  in  service 

but  allowance  has  already  been  made  for  an  improved  statistical  assessment  of  material 
properties  through  the  introduction  of  B values. 

3 THE  PROBABILISTIC  APPROACHS 

3.1  Instantaneous  Probability  of  Failure 

It  has  been  demonstrated  by  Hooked  that  at  a given  time  in  the  life  of  a structure 
the  instantaneous  probability  of  failure  may  be  obtained  if  probability  density 
distributions  of  structural  strength  and  of  applied  loading  are  available.  (See  Fig  1} . 
This  probability  is  compounded  from  the  conditions  of  load  exceeding  strength  and  is 
clearly  dependent  upon  the  shape  of  the  "tail"  portions  of  the  intersecting  probability 
density  diagrams,  together  with  the  ratio  of  the  mean  values  of  tho  load  and  strength 
as  given  by  the  ultimate  factor  (assuming  a reserve  factor  of  unity) . 

A pilot  calculation  has  been  performed  assuming  a normal  distribution  (for  the 
convenience  of  available  tabulated  properties)  for  both  the  load  and  strength  probabilities, 
and  the  S2une  value  of  standard  deviation  in  each  case.  For  cui  ultimate  factor  of  1.5 
it  was  found  necessary  to  assume  a minimum  value  of  the  standard  deviation  of  0.052  x 
mean,  so  as  to  remain  within  the  available  data  range  (max  of  4 standard  deviations  from 
the  mean  value) . Fig  2 shows  the  resulting  variation  in  probability  of  failure  per 
flight  against  ultimate  factor,  assuming  no  structural  deterioration  with  time. 

The  assumed  distributions  give  a large  increase  in  probabiU^ty  of  failure  as  the  ultimate 
factor  is  reduced. 

Using  more  representative  statistical  data  on  aircraft  loading  and  strength  gives 
less  severe  trends.  Dr  A. 0. Payne,  a co-worker  of  Hooke  at  ARL,  has  applied  the  above 
approach  using  probability  density  data  derived  from  manoeuvre  load  statistics  and  from 
structural  strength  statistics  on  major  aircraft  components'^.  Payne's  curve  of 
probability  of  failure  against  ultimate  factor  is  included  in  Fig  2,  showing  a marked 
difference  in  gradient  from  the  "normal  distributions"  curve. 

3.2  Cumulative  Probability  of  Failure  (Constant  Strength  Structure) 

The  pilot  calculation  was  continued  to  determine  the  cumulative  probability  of 
failure  against  number  of  flights,  initially  assuming  constant  strength  structure. 

The  Theorem  of  Total  Probability  gives  the  probability  of  at  least  one  failure  in  n 
f lights j- 

P = 1 - (1  - p)n 

Whare  p = constant  probability  of  failure  per  flight. 

Since  p is  of  small  order  the  expression  simplifies  tc;- 

P “ np 

Applying  this  equation  to  the  data  from  Fig  2 gives  the  curves  of  cumulative 
probability  against  number  of  flights  and  ultimate  factor  shown  in  Fig  3.  The  main  array 
of  curves  is  from  Payne's  work,  but  also  shown  for  reference  are  the  lines  corresponding 
to  the  assumed  normal  distributions  in  the  pilot  calculation,  again  illustrating  the 
sensitivity  of  these  calculations  to  the  input  data. 

3 . 3 Cumulative  Probability  of  Failure  (Deteriorating  Structure) 

The  final  stage  of  the  pilot  calculation  was  to  consider  the  effects  of  structural 
deterioration  towards  the  end  of  the  service  life.  A safe-life  design  was  considered, 
using  data  on  residual  strength  against  life  presented  by  Payne®  and  assuming  a service 
life  of  3000  flights.  At  a given  ultimate  factor  (intact  structure)  tho  variation  in 
mean  strength  during  the  period  of  structural  deterioration  was  expressed  in  terms  of  a 
progressive  reduction  in  the  ultimate  factor  to  a value  of  1.2  at  t)je  end  of  the  life 
(AVP970  residual  strength  requirement  *■  1.2  x limit  Ipad).  Payne's  data  was  adapted  to 
produce  curves  of  moan  residual  strength  against  life  (sea  Fig  4)  for  various  ratios  of 
final  residual  strength  to  intact  structure  ultimate  strength.  The  cumulative 
probability  of  at  least  one  failure  shows  a rapid  increase  during  tho  period  of  structural 
deterioration  as  shown  in  Fig  3 for  various  values  of  the  ultimate  factor. 

The  effect  of  the  specified  mode  of  structural  deterioration  vis  a vis  non- 
deteriorating  structure  is  illustrated  in  Fig  5,,  which  shows  the  cumulative  probability 
of  at  least  one  failure  in  the  service  life  of  3000  flights.  The  figure  shows  clearly 
how  the  residual  strength,  requirement  governs  this  probability  and  illustrates  the 
diminishing  returns  obtained  from  an  increase  in  the  ultimate  factor.  It  is  interesting 
to  note  that  the  existing  ultimate  factor  of  1.5  gives  a reasonable  balance  between  the 
probabilities  for  the  intact  and  deterio,rated  structures  (ratio  1:3). 
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3 , 4 Future  Possibilities 

The  above  exploratory  exercise  indicates  the  potential  of  the  statistical  approach 
as  a means  of  rationalisinq  the  determination  of  ultimate  factors.  It  is,  however, 
clear  that  the  results  of  this  type  of  analysis  are  very  sensitive  to  the  data  input,  in 
particular  to  the  probability  density  distributions  of  loadinq  and  strength  and  to  the 
shape  of  the  structural  deterioration  curve. 

In  the  case  of  the  probability  distributions  there  is  the  problem  of  obtaining 
adequate  statistics  of  rare  events  in  the  "tail"  portions  of  the  curves. 

In  the  case  of  the  structural  deterioration  curves  the  variation  of  residual  strength 
with  time  will  depend  upon  the  damage  tolerance  philosophy  and  structural  configuration 
and  materials  employed. 

The  possibility  of  achieving  a weight  saving  by  a reduction  of  the  ultimate  factor 
is  of  course  attractive,  but  must  be  considered  in  terms  of  the  increased  cumulative 
probability  of  failure  and  of  changes  in  the  presently  accepted  margins  between  limit, 
proof  and  ultimate  loads.  These  margins  themselves  should  be  rationalised  on  a consistent 
statistical  basis  with  the  probability  dansity  distribution  of  loading  used  in  the  above 
calculation. 

4 SENSITIVITY  OF  COMBAT  AIRCRAFT  MASS  TO  CHANGE  IN  ULTIMATE  FACT0R9 

4.1  Procedure 

Three  typical  copibat  aircraft  configurations  were  examined:  delta  wing,  fixed  wing, 

and  variable  geometry  wing  aircraft  (aspect  ratios:  1.9,  3.5,  7.0  respectively). 

The  study  was  in  two  stages.  In  the  first  stage,  the  reductions  in  safety  factor 
were  obtained  by  reducing  the  ultimate  factor  oroqressively  from  1.5  to  1.0  and  the 
undercarriage  vertical  descent  velocity  was  reduced  by  a corresponding  amount.  Design 
diving  speed  sr.d  maAlrnurn  Mach  niimber  were  Kept  constant,  althouoh  an  allowcince  was  made 
for  reducing  the  safety  factor  in  areas  designed  by  local  dynamic  pressure,  eg  Intake 
ducts,  fuselage  access  panels. 

The  resulting  reductions  in  mass  were  then  re-iterated  to  produce  the  maximum  savings 
possible  on  the  unsealed  aircraft. 

In  the  second  stage,  the  procedure  was  the  same  as  in  the  first  stage,  but  the  aircraft 
were  completely  re-sized  within  the  constraints  of  the  relevant  computer  program. 

4.2  Assumptions 

Stage  1 - 

(a)  Aircraft  size  unchanged 

(b)  Constant  fuel  and  payload 

(c)  Constant  power  olant 

Stage  2 - 

(a)  Constant  wing  loading  at  combat 

(b)  Constant  fuel  fraction  at  combat 

(c)  Power  plant  scaled  to  give  constant  thrust/mass  ratio  at  combat 

(d)  Fuselage  geometry  scaled  to  match  changes  in  power  plant  size  and 
fuel  requirement 

(e)  Constant  tail  volume 

(f)  All  fuel  carried  internally 

(g)  Aircraft  balance  maintained  by  insertion  or  removal  of  fuselage  "plugs" 

(h)  Stiffness  criteria  ignored. 

4 . 3 Results 

Tables  I,  II,  and  III  show  the  results  obtained  at  the  end  of  the  second  stage. 

The  results  are  quoted  as  percentages  of  the  combat  mass  for  the  datum  aircraft  with  an 
ultimate  factor  of  1.5. 


TABLE  I 

DELTA  WING  AIRCRAFT 


UF  « !.'• 

UF  = 1.25 

UF  = 1.0 

Wing 

9.4 

8.9 

8.5 

Tail  unit 

0.7 

0.7 

0.6 

Fuselage 

15.3 

14.1 

la.o 

Undercarriage 

6.8 

6.2 

5.7 

Total  Structure 

32.2 

29.9 

27.8 

Propulsion 

17.1 

16.6 

16.0 

Equipment 

21.5 

21.4 

21.3 

Mass  Elnpty 

70.8 

67.9 

65.1 

Payload  and  combat  fuel 

29.2 

28.5 

27.7 

Combat  mass 

100 

96.4 

92.8 

TABLE  II 

FIXED  WING  AIRCRAFT 


UF  - 1.5 

UF  = 1.25 

UF  - 1.0 

Wing 

9.6 

8.2 

7.1 

Tail  unit 

1.7 

1.6 

1.5 

Fuselage 

16.0 

14.5 

13.2 

Undercarriage 

6.7 

6.0 

5.4 

Total  Structure 

34.0 

30.3 

27.2 

Propulsion 

16.8 

15.9 

15.2 

Equipment 

22.5 

22.4 

22.2 

Mass  Empty 

73.3 

68.6 

64.6 

Payload  and  combat  fuel 

26.7 

25.7 

24.9 

Combat  mass 

100 

94.3 

89.5 

TABLE  III 


VARIABLE  GEOMETRY  WING  AIRCRAFT 


UF  « 1.5 

UF  X 1.25 

UF  « 1.0 

Wing 

16.7 

12.7 

9.7 

Tail  unit 

1.8 

1.7 

1.5 

Fuselage 

14.9 

13.1 

11.7 

Undercarriage 

6.6 

5.6 

4.9 

Total  Structure 

40.0 

33.1 

27.8 

Propulsion 

14.4 

13.1 

12.1 

Equipment 

21.8 

21.4 

21.1 

Mass  Etapty 

76.2 

67.6 

61.0 

Payload  and  combat  fuel 

23.8 

22.1 

20.8 

Combat  mass 

100 

89.7 

81.8 

Figures  6 and  7 show  the  relative  sensitivity  of  each  configuration  to  variations 
in  ultimate  factor. 
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4 . 4  Summary  of  Mass  Savings 

The  results  indicate  that  significant  mass  savings  can  be  obtained  by  reducing  the 
ultimate  factor,  but  no  account  has  been  taken  of  the  effects  of  such  a reduction  on 
fatigue  life  and  development  potential. 

Significant  savings  can,  however,  only  be  achieved  by  continuing  the  exercise  into 
the  cecond  stage,  le  by  rt-sizing  the  aircraft.  The  full  effects  of  reducing  the 
ultimate  factor  of  safety  can  thus  only  ‘be  realised  if  the  aircraft  is  designed  ab  initio 
with  the  reduced  factor. 

5 SENSITIVITY  OF  TRANSPORT  AIRCRAFT  STRUCTURE  MASS  TO  CHANGE  IN  ULTIMRTE  FACTOR^O 

5. 1 Objectives  and  Terms  of  Reference 

The  Trident  3B  was  selected  as  a typical  civil  airliner.  The  objective  was  to  obtain 
the  change  in  the  total  structure  weight  of  the  aircraft  due  to  a reduction  in  the  ultimate 
factor.  Design  limit  loads.  Including  the  effects  of  structural  flexibility,  were  taken 
as  unchanged.  The  reduction  in  factor  applied  to  all  static  design  cases. 

The  stiffness,  minimum  fatigue  crack  free  life  and  daunage  tolerance  design 
requirements  and  aims  were  not  changed,  nor  was  the  HSA  "in-house*  ultimate  factor  of  3,0 
on  pressure  loads  alone  for  static  strength  of  pressure  cabins,  for  parts  designed  by 
tension  or  shear  loads  (eg  pressure  bulkheads  and  floors) . 

The  only  mass  savings  derived  in  this  exercise  were  for  those  component  parts  designed 
by  static  strength  requirements,  eg  wing  top  surface. 

All  items  of  the  structure  were  considered.  Including  the  non-metallic  parts,  eg 
canopy  and  cabin  windows,  cabin  floors,  paint  etc. 

Particular  static  strength  requirements  such  as  crash  cases  and  bird  impact  were 
retained  unchanged,  as  were  the  specified  minimum  material  thicknesses. 

5.2  Trident  3B  Basic  Weights 

Design  take-off  weight 
Design  landing  weight 
Maximum  aero  fuel  weight 
APS  weight 

Total  structure  weight 

5. 3 Structure  Mass  Reduction 

All  components  of  the  aircraft  were  examinee  under  the  conditions  outlined  above, 
the  detailed  results  with  the  associated  criteria  being  given  in  Table  IV. 

The  total  structure  mass  reduction  ^^nounted  to  1312  lb  (600  kg)  being  approximately 
3,5%  of  the  total  structure  weight. 

5.4  Benefits  Which  Could  Accrue  from  this  Mass  Reduction 


lb 

kg 

150000 

68000 

128500 

58300 

115500 

52400 

83600 

38000 

40400 

18300 

The  mass  reduction  of  1312  lb  could  be  utilised  in  at  least  the  following  four 
alternative  ways;- 

a)  Increase  in  payload.  1312  lb  « 4%  of  maximum  payload  » 6 passengers  plus 
baggage  (at  210  lb  per  passenger). 

b)  Increase  in  range  with  maximum  payload.  1312  lb  - 165  imperial  gallons 
of  fuel. 

c)  Reduction  of  wing  area  to  keep  ths  wing  loading  unchanged: 

Wing  loading  » 100  Ib/ft^ 

A reduction  of  15  ft2  in  wing  area  keeps  the  wing  loading  const:mt 

d)  Possible  omission  of  the  boost  engine  in  the  rear  of  the  fuselage. 

Boost  engine  mass  « 660  lb  : SLST  » 5250  Ibf 

5.5  Conclusions  from  this  Exercise  on  the  Trident  3B  Structure 


a)  The  relationship  between  structure  mass  and  ultimate  factor  is  1%  mass 
reduction  per  2%  reduction  in  factor,  within  say  a maximum  of  10%  change 
in  factor. 

b)  A reduction  in  factor  from  1.5  to  1.4  would  mean  a change  in  probability  of 
occurrence  of  Ultimate  load  from  10-7  per  hour  to  2 x 10-7  per  hour,  assuming 
limit  loads  have  a probability  of  occurrence  of  10-5  per  hour. 

c)  The  benefits  which  could  result  are  such  that  a reduction  in  ultimate  factor 
could  be  actively  pursued,  bearing  in  mind  the  good  safety  standard  achieved 
in  service. 
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TABLE  IV 
STRUCTURE  MASSES 


COMPONENT 

STRUCTURE  DESIGN  CRITERIA  STRUCTURE 

MASS  SAVING 

PER  A/C  lb  PER  A/C  lb 

Wing  top  surface 

Static  strength :compresaion 

2764 

170 

bottom  surface 

Fatigue, fail  safety  and  Gc-’n  gust 
strength  retained 

2712 

0 

spars 

Mainly  static  strength:shear ,tank 
pressures 

2227 

130 

ribs 

Mainly  static  strength 

1356 

88 

control  surfaces 

Stlf f ness, fatigue , static  strength, 
minimum  thickness 

2779 

80 

LE,  TE  structure 

Bird  impact, static  strength 

2900 

70 

TOTAL 

14738 

538 

Fuselage  main  shell  (skin 
stringers , frames) 

Fatigue, fail  safety;  18  swg  skin  is 
a minimum  in  the  pressure  cabin; 
static  strength 

6593 

140 

pressure  bulkheads 
and  floors  and  main 

Static  strength  (HSA  UF  = 3.0) static 
strength, fatigue  loads 

3127 

164 

spar  frames 
cockpit  and  cabin 
windows 

Bird  impact; working  stress  levels 
retained 

1225 

0 

cockpit  and  cabin 

1172 

0 

floors 

doors  cind  surrounds 

Pressure , static  strength  and  fatigue 

1221 

30 

floor  beams, scat 
rails 

Crash  cases  unchanged; other  static 
cases  exist 

1048 

35 

freight  bay  floors 

Static  strength ;minimum  thickness  in 
part 

726 

35 

other  structures 
(side  engines  support, 
U/c  support  structure 
fairings , paint) 

Static  strength , fatigue 

1519 

60 

TOTAL 

16632 

464 

Tailplane  + elevator 

Static  strength , fatigue , stiffness 

2050 

80 

Fin  + rudder 

Fin  fatigue  (side  gusts) 

1240 

30 

Main  cind  nose  u/c 

No  mass  reductions  on  wheels , brakes , 
j aoks 

5503 

200 

Engine  mountings 

Fatigue , vibration , stiffness 

282 

0 

TOTAL  A/C 

40400 

1312 

6 CONCLUSIONS 


The  prlma  facie  case  shows  that  Improved  design  and  production  techniques  should 
make  a reduction  in  ultimate  factor  possible  without  a corresponding  loss  in  safety 
standards. 

The  studies  into  the  sensitivity  of  aircraft  mass  to  changes  in  the  ultimate  factor 
show  a significant  trend  for  transport  aircraft.  For  combat  aircraft,  the  reductions 
in  mass  are  worthwhile  only  if  the  aircraft  are  re-sized. 

The  probabilistic  approach  shows  the  need  for  accurate  data  on  which  to  base  the 
statistical  survey.  Future  research  into  the  possibilities  of  reduced  factors  of  safety 
should  therefore  concentrate  on  the  collection  and  analy.sls  of  this  data. 
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ABSTRACT 

The  1.5  factor  of  safety  la  a highly  visible  airframe  design  parameter.  The  factor  is  empirically 
derived  and  provides  an  almost  universally  accepted  measure  of  flight  safety.  Although  the  measure  Is 
qualitative,  the  level  of  safety  provided  by  the  1.5  factor  has  become  an  accepted  standard.  These 
facts  have  developed  a tendency  among  engineers  to  both  challenge  the  continued  application  of  the  1.5 
factor  of  safety  for  efficient  airframe  design  and  yet  avoid  any  change  that  would  challenge  the  confidence 
of  future  designs.  The  unsettled  position  on  the  factor  of  safety  may  never  completely  stabilize  but 
It  can  be  clarified  by  reviewing  Its  historical  significance. 

In  U.S.  design  practice  the  significance  of  the  1.5  factor  of  safety  can  be  placed  In  perspective 
by  reviewing  Its  development  for  both  military  and  civil  use.  The  factor  evolved  as  a compromise 
opinion  based  on  flight  operations.  The  approximate  1.5  ratio  of  ultimate  stresa  to  yield  stress  for 
certain  materials  coming  Into  use  during  the  same  time  period  supported  the  decision  but  did  not 
Influence  the  selection  of  Che  1.5  factor  of  safety.  Since  the  time  of  Its  selection,  variations  and 
adaptations  to  ocher  aircraft  types  have  been  proposed  and  sometimes  used.  Several  variations  and 
experimental  applications  are  reviewed. 

The  factor  of  safety  design  concept  has  recently  lost  some  of  its  appeal  and  reliability-based 
concepts  have  been  emphasized.  As  part  of  Its  structural  design  criteria  development  program,  the  Air 
Force  has  sponsored  Investigations  to  develop  reliability-based  criteria.  Three  of  these  Investigations 
and  similarities  between  Che  factor  of  safety  and  reliability  concepts  are  reviewed.  Although  Che  use 
of  rellablllty-baeed  concepts  will  probably  increase,  their  application  to  airframe  design  may  be 
limited.  The  factor  of  safety  still  covers  many  contingencies  and  It  appears  at  this  time  there  will 
be  a continuing  need  for  some  factor. 


1.  INTRODUCTION 

From  the  beginning  of  flight  and  even  before  power  was  used,  the  concept  of  safety  was  considered, 
Wilbur  Wright,  In  a letter  to  his  .father.  Bishop  Milton  Wright,  on  September  23,  1900,  wrote  the  following; 

"I  am  constructing  my  machine  to  sustain  about  five  times  my  weight  and  am  testing  every 
piece.  I think  there  Is  no  possible  chance  of  its  breaking  while  in  the  air." 

Early  designers,  researchers,  and  pilots  were  Interested  In  safety  and  were  anxious  Co  establish 
facts  and  Information  Identifying  maximum  loads  on  various  parts  of  the  airplane.  Wind  tunnel  measurements 
made  before  and  after  1900  were  used  principally  to  predict  airplane  performance  rather  chan  structural 
strength,  but  In-fllght  loads  measurements  to  assess  strength  were  also  made  during  chose  early  days. 

To  thle  day,  occupant  safety  is  z primary  concern  In  designing  manned  vehicles  and  the  "factor  of 
safety"  has  become  a prominent  design  concept. 

The  historical  development  of  the  1.5  factor  of  safety  In  U.S.  practice  Is  largely  unknown,  even 
among  the  engineers  who  use  the  factor  frequently.  Although  not  without  criticism,  little  If  any 
thought  or  concern  Is  given  to  using  the  1.5  factor  in  day  to  day  design  applications.  This  fact  would 
seem  Co  reflect  Its  basic  acceptance.  This  Is  not  true,  however,  with  other  structural  design  requirements 
which  are  frequently  challenged  and  modified.  Design  specifications  and  practices  are  continuously 
reviewed  and  revised. 

A concertud  effort  to  "rationalize"  airplane  design  requirements  took  place  during  th>  1930' s as  a 
Joint  effort  between  the  Army,  Navy,  and  Civil  Aeronautics  Administration,  The  development  of  the  1.5 
factor  of  safety  Is  closely  related  to,  and  Interacts  with  this  "rationalization"  effort.  The  term 
"rational"  In  this  case  refers  to  a logical  rather  than  an  arbitrary  requirement. 

The  improvements  chat  evolved  were  the  result  of  a better  understanding  of  actual  airplane  operations 
as  they  occurred  durlr.g  the  1920*  s and  of  the  various  parameters  which  Influenced  design  loads  and  load 
factors.  For  example.  Reference  1 states  that  during  the  mld-192C's  a particular  formula  for  computing 
the  load  factor  capability  of  an  airplane  was  not  used  by  U.S.  designers,  since  flight  tests  had  shown 
this  formula  to  be  unreliable.  The  state  of  knowledge  at  that  time  provided  more  Information  about  the 
actual  maximum  loads  that  could  be  expected  In  flight  than  were  known  about  the  parameters  used  In  the 
forsula,  therefore  limiting  Its  effectiveness.  However,  as  a result  of  continuing  flight  and  ground 
tests,  and  engineering  studies,  overall  knowledge  grew  quickly  and  the  "rationalization"  of  earlier 
requirements  could  be  seriously  considered. 

Although  structural  design  requirements  tend  to  change  frequently,  the  1.5  factor  of  safety,  as 
adopted  and  applied  to  design  loads,  has  not  changed.  When  design  or  operational  problems  arise  or 
structural  failures  occur,  certain  corrective  changes  are  usually  made  to  the  design  specifications, 
load  prediction  techniques,  manufacturing  techniques,  envlronMntal  standards,  or  operational  restrictions 
of  the  alrplanu.  No  known  official  action  has  ever  been  taken  to  Increase  the  1.5  factor  of  safety. 

The  only  known  attempt  to  change  it  would  have  reduced  the  factor,  which  has  always  been  treated  In  a 
relatively  Independent  manner  with  respect  to  other  design  and  operational  criteria  since  Its  adoption. 

Specific  references  relating  to  the  origin  of  the  1.5  factor  of  safety  are  almost  nonexlstant. 

Like  many  design  requirements,  the  utilization  of  the  1.5  factor  of  safety  evolved  over  a period  of 
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time  and  It  Is  not  an  Independent  development.  The  interaction  o£  engineering  and  operational  experiences 
ate  docemented  under  unsuspecting  titles  that  do  not  allude  to  their  historical  relationship  with  the 
1.5  factor  of  safety. 

There  cas  a reasonable,  although  not  exhaustive,  search  of  the  open  literature  for  information 
relating  to  the  history  of  the  1.5  factor  of  safety,  but  there  were  no  directly  related  references 
found.  Fortunately,  several  related  articles  were  already  known  and  were  readily  available.  Those  few 
associated  references  that  were  found  are  related  to  the  "new"  interest  in  "rationalizing"  structural 
safety  on  a reliability  basis.  This  Interest  began  in  the  late  1950's  and  early  1960's.  It  is  concerned 
almost  entirely  with  replacing  the  current  1.5  factor  of  safety  with  probabilistic  Interpretations  of 
structural  safety.  Certainly,  today's  technology  can  better  handle  the  mathematical  and  computational 
aspects  of  a more  complex  safety  evaluation  and  may  have  prompted  the  current  Interest. 

Variations  to  the  conventional  factor  of  safety  .and  probabilistic  techniques  that  have  been  considered 
and  used  by  Che  U^^AF,  as  they  relate  to  static  structural  strength,  will  also  be  reviewed  to  show  how 
they  evolved  and  are  related  to  the  1.5  factor  of  safety. 

The  history  of  the  1.5  factor  of  safety  has  already  been  documented  by  two  of  the  people  actually 
involved  with  the  formulation  of  design  requirements  during  the  1920's  and  1930's.  Mr.  A.  F.pstein 
worked  for  the  Army  Air  Corps  Material  Center  from  1929  to  1940  and  prepared  the  original  Air  Corps 
Structures  Specification  X-1803  in  1936.  He  continued  his  career  in  the  U.S.  aircraft  industry  working 
in  Che  structural  loads  and  criteria  area  until  his  recent  retirement.  Mr.  F.  R.  Shnnley  worked  for 
Che  Civil  /Aeronautics  Administration  in  the  1930's  and  is  knowledgeable  of  Che  development  of  civil 
airworthiness  requirements.  Another  source  of  civil  airworthiness  requirements,  as  they  relate  to  the 
factor  of  safety,  is  a history  prepared  by  the  Los  Angeles  Regioral  Office  of  the  Civil  Aeronautics 
Admlnls..ration.  These  histories  are  given  as  References  2 (Military)  and  3 (Civil).  The  history  of 
the  1.5  factor  of  safety  given  in  this  paper  is  derived  almost  entirely  from  these  references,  which 
are  the  only  specific  sources  known  to  the  authors. 


2.  DEVELOPMENT  OF  THE  1.5  FACTOR  OF  SAFETY 


The  1.5  factor  of  safety  in  U.S.  design  practice  is  fundamental,  and  represents  a level  of  design 
safety  which  has  become  an  accepted  standard.  However,  engineers  now  challenge  the  continued  application 
of  the  1.5  factor  for  efficient  airframe  design,  and  yet  tend  to  avoid  any  major  change  in  design 
philosophy  that  would  challenge  the  confidence  of  future  design:  or  encourage  legal  entanglements.  The 
factor  currently  provides  a balance  between  design  efficiency  and  safety  and  it's  significance  can 
perhaps  be  placed  in  perspective  by  reviewing  both  its  military  and  civil  development.  Such  a review 
can  be  helpful  in  Judging  the  1.5  factor's  current  and  future  applicability. 

The  evolution  of  structural  design  criteria  from  the  semi-implrical  and  arbitrary  regulations  in 
effect  during  the  1920' s to  the  relatively  rational  criteria  established  by  1940  is  found  in  References 
2 and  3.  These  references  ace  indispensable  and  will  be  used  extensively  to  relate  the  history  of  the 
1.5  factor  of  safety  in  this  section. 

In  the  early  1920' s,  Che  U.S.  Army  Air  Service  maintained  as  a contractual  document  for  design, 
the  Handbook  of  Instructions  for  Airplane  Design  (HIAD).  Mr.  Mfred  S.  Niles,  in  his  book  "Airplane 
Design"  published  by  the  Engineering  Division  of  the  U.S.  Army  Air  Service  in  1926  (Reference  1), 
detailed  the  structural  criteria  found  in  the  1925  edition  of  the  handbook.  The  handbook  criteria, 
although  adopted  independently,  was  the  result  of  a four  year  effort  to  obtain  Identical  design  rules 
by  the  Army  and  Navy.  In  most  cases,  agreement  was  reached. 

Civil  airplane  design  practice  paralleled  c'.ie  development  of  military  practice.  Civil  air  regulation 
began  in  1926  and  requirements  were  published  in  Aeronautics  Bulletin  No.  7-A,  "Airworthiness  Require- 
ments of  Air  Commerce  Regulations."  The  bulletin  was  kept  up  to  date  by  periodic  revisions  and  was 
replaced  in  1938  by  Fart  04  of  the  Civil  Air  Regulations,  in  keeping  with  adoption  of  the  Civil  Ae..'onautlcs 
Act  of  1938  (Reference  3a). 


The  Army  and  Navy  specified  design  load  factors  for  three  flight  attitudes,  as  shown  in  Figure  1. 
Two  of  these,  low  and  high  incident  (angle  of  attack)  attitudes,  were  associated  with  dive  recovery 
initiation,  and  final  recovery  from  a pull-up  to  maximum  load  factor.  The  low  incident  dive  attitude 
with  its  aft  center  of  pressure  usually  designed  the  rear  wing  spar.  The  associated  design  load  factor, 
which  was  two-thirds  of  the  high  incident  value,  was  based  on  a lift  coefficient  of  one-fourth  the 
maximum  lift  coef  ficienv..  T'l-.ia  wua  « . r.r..-ant  at  the  time,  .-ona'darlr.r  th- 


limited  speed  range  of  the  airplanes  and  the  reduced  lift  coefficient  at  the  low  incident  design  point. 
The  range  of  speed  from  stall  to  maximum  was  sufficiently  restricted  that  when  a high  load  factor 
maneuver  was  performed,  the  airplane  would  generally  come  close  to  the  maximum  lift  coefficient.  To 
achieve  the  same  maximum  load  factor  at  low  Incidence,  where  Che  lift  coefficient  was  one-fourth  the 
maximum,  twice  the  speed  would  be  required.  Such  a speed  could  not  be  achieved  and  thus,  the  reduced 
factor  was  realistic.  The  third  flight  attitude  for  which  design  load  factors  were  specified  was  that 
of  inverted  flight. 


Civil  airplane  design  load  factors  were  originally  based  upon  actual  acceleration  measurements 
during  Air  Corp  tests  in  the  early  1920' s.  To  avoid  establishing  categories  or  weight  classifications 
for  various  alrplcne  types,  the  Jioad  factors  were  made  dependent  on  airplane  gross  weight  and  power 
loading.  Until  1932  load  factors  were  given  in  chare  form  using  these  two  variables.  These  load 
factors  were  modified  slightly  in  1932  for  airplanes  having  low  power  loadings.  The  requirements  in 
Bulletin  7-A  were  revised  in  1934  to  Include  certain  basic  performance  and  design  characteristics  by 
using  empirical  equations  based  on  previous  operational  practice.  Although  the  load  factor  charts  were 
known  to  neglect  Important  airplane  clmracterlstics,  such  as  wing  loading  and  drag,  no  substantial 
changes  were  made  in  the  maneuvering  load  factors  themselves.  The  load  factor  charts  were  replaced  in 
1934  by  an  empirical  equation  and  the  minimum  design  load  factor  was  reduced  from  4.0  to  3.75  because 
of  satisfactory  experience  with  large  flying  boats  (Reference  3a) . 

The  term  "factor  of  safety"  was  recognized  in  a general  sense,  but  various  interpretations  were 
applied.  During  the  1920'8  and  early  1930's,  all  loads  were  ultimate  and  airplanes  were  designed  to 


load  factors  which  varied  for  each  type.  Reference  1 defines  factor  of  safety  as  the  ratio  between 
ultimate  load  and  maxirum  probable  load.  It  states  that  the  least  factor  of  safety  used  for  airplanes 
is  usually  2.0  and  that  the  term  "factor  of  safety"  is  often  used  incorrectly  in  place  of  the  term 
"load  factor."  A nearly  identical  definition  for  factor  of  safety  was  in  use  in  Bulletin  7-A  in  1929, 
and  its  use  may  have  been  the  result  of  Mr.  Niles’  Influence  (Reference  1).  In  a minor  sense,  terminology 
was  a problem  and  Reference  1 also  gave  definitions  for  design  load,  normal  load,  ultimate  load,  load 
factor,  and  margin  of  safety.  Similar  terms  were  also  defined  in  the  193A  edition  of  Bulletin  7-A. 

Vfhlle  writing  Air  Corps  Specification  X-1803  in  1936,  Mr.  Epstein  noted  the  ambiguousness  of  the 
terms  "applied"  and  "design"  and  proposed  "limit"  and  "ultimate."  The  new  terms  were  later  adopted  in 
a Joint  meeting  of  Army,  Navy  and  Commerce  Department  representatives,  the  forerunner  of  the  group  that 
later  originated  the  ANC  programs,  which  are  shown  in  Figure  2.  The  accepted  terms  first  appeared  in 
the  1940  changes  to  Specification  X-1803. 

The  first  edition  of  the  Civil  Air  Regulations,  Issued  in  1938,  Included  the  same  terminology 
change.  The  terms  "design"  and  "applied"  were  replaced  by  "ultimate"  and  "yield."  Both  of  the  new 
terms  referred  to  loads  required  to  be  withstood  by  the  structure.  The  term  "limit"  was  also  introduced 
to  specify  the  "actual"  or  "expected"  load  factor.  The  limit  load  factor  represented  a flight  limitation 
for  which  the  airplane  was  expected  to  be  completely  alrwortb*  (Reference  3b). 

As  defined  in  Reference  1,  Mr.  Niles  seems  to  have  Ignored  the  maximum  maneuver  load  factor 
capabilities  of  the  airplane  in  his  assessment  of  the  factor  of  safety  of  2.0.  He  apparently  used  only 
the  more  typically  achieved  maneuver  load  factors  when  assessing  the  difference  between  actual  and 
d >lgn  loads.  There  were  no  flight  restrictions  to  limit  maneuvers,  for  example,  to  half  the  ultimate 
design  load  factor  (to  Insure  a factor  of  safety  of  2.0)  and  it  was  characteristic  at  the  time  to  use 
the  more  typical  (or  average)  maneuver  load  factors  as  a basis  for  design  regulations.  The  Civil 
A..rondutIcs  Administration  during  the  same  period  specified  only  a load  factor  value  (ultimate)  in  the 
order  of  6.0  for  a typical  airplane.  The  implication  was  that  the  airplane  structure  shoul i not  fail 
before  reaching  6.0G  in  flight.  There  were  no  maneuver  load  limitations  specified  but  there  was  the 
assumed  factor  of  safety  of  2.0. 

During  the  1920' s,  operational  flight  load  factors  began  to  Increase.  In  1921,  Reference  4 stated 
that  a load  factor  of  4.5  was  sufficient  for  stunting  based  on  flight  tests  using  a JN-4H  airplane. 

The  Air  Corps,  in  flight  tests  conducted  in  1924,  recorded  a load  factor  of  7.8  in  a PW-7  airplane 
flown  by  James  Doolittle.  This  factor  was  the  highest  reached  and  occurred  curing  a sharp  pull-up  at 
162.5  mph  (Reference  5).  The  7.8G  compared  to  the  theoretical  maximum  of  8.15G  at  max  and  a design 
factor  of  8.5G.  The  7.8  load  factor  certainly  could  not  be  considered  in  the  "maximum  probable  load" 
category  when  considering  the  factor  of  safety  definition  in  Reference  1,  but  rather  as  an  Improbably 
high  load.  Similarly,  the  thought  that  airplanes  had  an  approximate  factor  of  safety  of  2.0  was  more 
of  an  opinion  which  was  based  on  limited  operational  data  and  not  on  aerodynamic  capability.  Pursuit 
airplane  design  load  factors  were  Increased  to  12  when  it  was  realized  that  the  8.5  design  load  factor 
then  in  effect  could  be  readily  exceeded. 

In  1927  (Reference  6),  a Navy  F6C-4  airplane  developed  a load  factor  of  10. 5G  during  a pull  up  and 
in  1930  (Refercn..e  7)  a FW-9  pursuit  airplane  reached  accelerations  up  to  9G  during  flight  load  test 
programs.  Both  of  these  airplanes  were  designed  to  ultimate  load  factors  of  12G.  However,  there  were 
no  further  increases  in  pursuit  airplane  design  load  factors  as  a result  of  these  experiences. 

The  Army,  Navy  and  CAA  began  during  the  early  1930's  to  "rationalize"  their  design  requirements. 

The  objective  was  to  relate  the  air  loads  more  closely  to  actual  flight  conditions.  This  effort  eventually 
resulted  in  the  introduction  of  gust  loading  conditions,  airplane  speed,  the  V-G  diagram  and  the  use  of 
aerodynamic  derivatives.  A number  of  the  more  significant  milestones  in  the  evolution  toward  rational 
criteria  are  described  in  Reference  2c.  The  1.5  factor  of  safety  evolved  from  this  "rationalization" 
process  as  an  outgrowth  of  the  flight  test  programs  conducted. 

The  formal  introduction  of  a factor  of  safety  of  1.5  into  Air  Corps  requirements  occurred  in  1930 
but  it  only  applied  to  establishing  design  tall  loads.  The  HIAD  (handbook)  design  loads  for  the  horizontal 
tails  at  that  time  were  admittedly  arbitrarv  and  insufficient  for  the  expected  service  of  many  airplanes. 
Reference  8 established  a new  method  which  consisted  of  determining  the  steady-state  flight  path  and 
speed  of  Che  airplane  with  zero  power,  assuming  a complete  range  of  angles  of  attack  from  maximum 
positive  CO  maximum  negative.  The  balancing  tail  load  was  then  computed  for  each  of  these  points. 

The  balancing  tail  loads  so  defined  were  further  adjusted  by  a velocity  factor  and  increased  50  percent 
for  design.  Thu  50  percent  factor  over  the  computed  load  was  termed  the  factor  of  safety  for  material. 

The  adoption  of  this  design  technique  also  introduced  the  use  of  airplane  speed  and  aerodynamic  derivatives 
(wing  moment  coefficients)  as  requirements. 

The  flight  loads  program  reported  In  Reference  7 was  the  most  comprehensive  undertaken  up  to  that 
time  (1930).  It  was  conducted  at  the  request  of  the  Air  Corps  to  determine  the  magnitude  and  distribution 
ol  loads  over  the  wing  and  tall  surfaces  of  a PW-9  pursuit  airplane  during  maneuvers  most  likely  to 
Impose  critical  loads.  The  maneuvers  included  pull-ups,  rolls,  dives,  and  Inverted  flight.  Pressure 
distributions  and  load  time  histories  were  recorded.  The  distributed  loads  measured  over  the  tall 
surfatub  were  two-thirds  of  the  design  loads  and  assuming  that  the  factor  of  safety  of  2.0  applied,  the 
report  concluded  that  the  design  load  criteria  should  be  increased.  The  same  data  in  Reference  7 were 
again  evaluated  in  Reference  9.  In  Reference  9,  the  authors  assumed  that  the  maximum  operational  loads 
were  the  specified  ultimate  design  loads  divlocd  by  a 1.5  factor  of  safety.  The  measured  tall  loads 
actually  were  about  two-thirds  of  Che  design  values  and  helped  to  substantiate  the  1.5  assumption, 
although  it  was  a weak  assumption  in  a statistical  sense.  It  was  their  belief  that  the  requirements 
were  based  on  "an  anticipated  load  factor  plus  a margin  of  50  percent  to  allow  for  possible  imperfections 
of  Mterlal,  approximations  of  analysis  and  general  lack  of  knowledge  of  loads."  In  Reference  7 and  9, 
then,  we  see  two  conclusions  based  on  the  same  data.  Each  "conclusion"  occurred  by  assuming  a different 
factor  of  safety. 

.Although  some  disagreement  and  possible  confusion  seemed  to  exist,  it  could  have  been  worse. 
Presumably,  if  the  2.0  factor  had  been  considered  the  norm,  the  12G  PW-9  airplane  should  not  even  have 
been  permitted  to  exceed  SG.  If  the  highest  9G  load  factor  recorded  by  the  PW-9  airplane  had  been 
considered  and  compared  to  the  12G  design  load  factor,  an  even  lower  1.33  factor  of  safety  could  have 
been  assumed  when  evaluating  the  flight  data  in  Reference  7.  Now  consider  again  the  factor  of  safety 


o£  2.0.  If  it  was  still  the  accepted  norm  as  assumed  in  Reference  7,  then  the  "new"  conclusion  in 
Reference  9,  that  a 1.5  factor  of  safety  prevailed  during  flight  operations,  was  not  adequately  supported. 
The  assumed  need  for  a factor  of  safety  of  2.0  in  1925  was  just  as  valid  as  assuming  the  1.5  factor 
existed  in  flight  operations  in  1931.  Neither  value  could  be  substantiated  statistically.  Clearly,  a 
change  in  thinking  had  occurred  as  a result  of  operational  practice  and  available  flight  test  data. 

Mr.  Epstein  notes  in  Reference  2c  that  his  thinking  followed  this  pattern.  In  the  early  1920' s a 
factor  of  2.0  was  considered  necessary  as  implied  in  Reference  1 by  Niles.  In  the  late  1920's,  actual 
operational  flying  of  the  newer  airplanes  were  coming  closer  to  the  ultimate  load  factor  than  earlier 
models.  Airplanes  were  flying  up  to  two-thirds  and  more  of  the  ultimate  load  factor  and  nothing  was 
happening  to  the  structure;  therefore,  the  evolution  of  thinking  toward  a lower  factor  of  safety  was  a 
natural  one. 

Mr.  Shanley  expressed  similar  thoughts  in  Reference  3a.  He  favored  using  a 1.5  factor  of  safety 
to  keep  the  permissible  limit  loads  relatively  high,  as  compared  to  a factor  of  2.0.  Although  a require- 
ment relating  limit  loads  to  the  absence  of  permanent  set  had  not  yet  been  written,  Mr.  Shanley  Interpreted 
limit  load  at  that  tii>ie  as  not  exceeding  yield  strength. 

As  summarized  by  Mr.  Epstein  in  Reference  2c,  the  factor  of  safety  was  considered  a variable  which 
depended  upon  the  sample  of  flight  data  used,  and  personal  judgement  as  to  the  bases  to  be  used  in 
assessing  the  factor.  In  terms  of  actual  strength,  there  was  no  way  of  knowing  a true  factor  of  safety 
in  view  of  the  limited  knowledge  of  loads  and  stress  analysis. 

At  this  point  in  time,  a factor  of  safety  philosophy  had  essentially  evolved,  but  had  not  been 
formalized.  Airplanes  were  flying  at  two-thirds  of  ultimate  load  factor,  permanent  set  was  not  desirable, 
permissible  limit  loads  should  be  as  high  as  possible,  and  a 1.5  factor  was  already  in  use  to  establish 
design  tail  loads.  Yet,  there  was  no  formally  established  relationship  between  design  load  factor, 
maximum  aerodynamic  maneuver  capability  and  operational  maneuver  limits.  These  relationships  would 
evolve  with  the  development  of  the  V-G  diagram. 

The  concept  of  a V-G  diagram  that  defines  the  design  boundaries  of  an  airplane  is  generally  attributed 
to  Richard  Rhode.  Prior  to  the  adoption  of  this  concept,  the  factor  of  safety  had  limited  significance. 

The  diagram  itself  appeals  obvious  and  elementary  but  it  represents  a major  milestone  leading  to  rational 
criteria.  Tlie  Navy  Bureau  of  Aeron.iutlcs  was  the  first  to  specify  this  diagram,  shown  in  Figure  3, 
as  a requirement  in  1933. 

In  the  interest  of  establishing  standardized  design  requirements  with  the  Navy,  the  Air  Corps  had 
initiated  a study  of  the  Navy  series  of  criteria  specifications  (Reference  10)  in  May  1933.  The  result 
of  this  study  is  found  in  Reference  11.  Much  of  the  diagram's  development  effort  evolved  around  the 
definition  of  the  upper  left  and  right  hand  corners  of  the  envelope.  The  Navy  had  specified  rounded 
corners.  An  existing  Air  corps  requirement  called  for  the  maximum  load  factor  to  occur  at  maximum  lift 
coefficient  and  therefore  recommended  that  the  maximum  acceleration  and  maximum  lift  coeffi:lent  line 
form  the  upper  left  hand  corner.  This  point  was  adopted.  For  consistency,  the  lower  left  corner  was 
made  the  intersection  of  the  negative  maximum  lift  coefficient  line  and  the  negative  design  load  factor. 

The  Air  Corps  also  recommended  that  the  upper  right  hand  corner  be  a right  angle  to  provide  a definitive 
low  angle  of  attack  design  point. 

To  counter  Che  argument  chat  airplanes  performed  satisfactorily  in  service  with  reduced  load 
factors  for  this  low  incidence  (angle  of  attack)  corner,  Mr.  Epstein  noted  chat  stress  analysis  was 
inherently  conservative  and  the  structure  was  actually  stronger  than  analysis  indicated.  Further 
evidence  to  justify  a right  angled  upper  right-hand  corner  was  provided  by  data  in  Reference  12  where  a 
P-12C  airplane  was  shown  to  have  Initiated  a pull  up  from  a vertical  dive,  starting  at  250  miles  per 
hour.  A maximum  speed  of  255  miles  per  hour  was  reached  and  a maximum  load  factor  of  8.5  was  developed 
(at  low  angle  of  attack)  at  248  miles  per  hour,  which  was  only  a slight  reduction  from  the  maximum 
speed. 

Maximum  speeds  were  already  defined  for  design  purposes  as  either  the  terminal  velocity  in  a 
vertical  dive,  which  was  applicable  for  pursuit  airplanes,  or  as  a restricted  speed  given  in  a percentage 
of  high  speed.  These  speed  del Inlt ions  were  also  used  to  form  the  maximum  speed  line  for  the  V-G 
diagram.  The  upper  and  lower  right  hand  corners  were  finally  adopted  as  right  angle  intersections  of 
the  maximum  speed  line  and  the  maximum  positive  and  negative  acceleration  lines.  With  the  adoption  of 
the  V-C  diagram,  the  tail  load  requirements  of  Reference  8 became  obsolete  because  airplanes  were  then 
required  to  be  balanced  for  all  points  of  the  diagram. 

The  maximum  design  locc!  factor  boundary  of  the  V-C  Diagram  had  in  essence  already  been  established. 

The  precedent  not  to  design  tu  the  maximum  aerodynamic  capabllltltcs  of  an  airplane  had  already  been 
established  in  Reference  9,  which  states  that,  "If  the  attempt  is  made  to  design  present  service  pursuit 
airplanes  to  take  care  of  the  highest  accelerations  so  far  observed,  10. 5G,  and  still  retain  a factor 
of  safety  of  1.5,  the  ultimate  design  load  factor  would  have  to  be  raised  to  15,75."  This  high  factor 
was  felt  to  be  unwarranted  by  virtue  of  the  accompanying  weight  increase  and  loss  in  performance, 

Therefote,  the  principle  of  not  designing  to  the  maximum  recorded  load  factors  was  recognized  and  the 
maximum  load  factor  boundary  for  the  V-G  diagram  was  established  by  the  load  factors  then  in  use. 

Having  agreed  on  the  boundary  of  the  V-G  diagram,  the  question  of  how  to  use  the  diagram  in  conjunc- 
tion with  the  factor  of  safety  as  a design  and  operational  boundary  remained  to  be  resolved.  The  Army 
and  Navy  differed  in  opinion  as  to  whether  the  V-G  diagram  should  be  an  ultimate  or  a limit  diagram. 

The  Navy  V-C  diagram  represented  an  clastic  limit  requirement.  Yet  the  limit  was  difficult  to  define 
because  the  Navy  did  not  have  a fl2!ed  factor  of  safety.  Appendix  II  of  Navy  Specification  3S-1  (Refer- 
ence 10)  states  that  the  ratios  of  ultimate  strength  to  elastic  limit  strength  should  be  equal  to  or 
greater  than  1.35  for  all  conditions  except  the  dive.  In  which  case  the  factor  is  to  bo  a minimum  of 
1.5.  Wing  cells  were  to  be  designed  to  any  point  within  the  V-G  diagram  without  exceeding  the  elastic 
limit  ot  .any  structural  member  and  the  horizontal  tail  liad  to  sustain  the  maximum  balancing  load  multi- 
plied by  1.5  without  purm_.ient  set,  and  by  2.0  without  failure.  The  Navy  also  had  a flight  V-G  diagram 
and  a requirement  that  the  flight  loads  shcald  not  exceed  the  clastic  limit  of  the  structure.  Appendix 
II  suggested  a factor  of  1 05  or  1.10  us  the  flight  elastic  true  (yield)  factor  of  safety. 

The  Afr  Corps  study  In  Reference  11  recommended  the  adoption  of  a single  factor  of  safety  as  a 
preferable  alternative  to  the  variety  specified  by  the  Navy.  Since  an  Air  Corps  precedent  for  using  a 
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1.5  factor  of  safety  hJid  already  been  established,  it  was  recommended  that  the  1.5  factor  be  adopted 
for  the  V-G  dlagr.am.  However,  the  Air  Corps  also  recommended  that  the  V-G  diagram  be  an  ultimate 
rather  than  a yield  diagram  as  the  JJavy  had  been  using  it.  The  Air  Corps  proposed  flight  limits  were 
to  be  two-thircSs  of  the  ultimate  factors  shown  by  the  diagram. 

This  design  philosophy  was  incorporated  into  Revision  6 of  the  UIAD,  dated  March  1934  and  the  1.5 
factor  of  safety  became  a formal  Air  Corps  requirement.  The  use  of  an  ultimate  V-G  diagram  was  later 
changed  by  the  Air  Corps  to  a design  load  factor  diagraia  in  August,  1936,  when  Specification  X-1803  was 
issued.  Based  on  available  records,  the  reason  tor  this  change  in  thinking  is  not  clear.  Apparently 
the  original  concerns  leading  to  the  recommendation  of  an  ultimate  diagram  must  have  been  alleviated. 

The  original  concern  that  led  to  the  ultimate  V-G  diagram  reccmmcndatlon  was  related  to  the  secondary 
non-linear  bending  load  effects  with  load  factor  found  in  the  wing  spars  of  biplanes  and  braced  mono- 
planes. An  explanation  of  this  concern  is  given  in  Reference  1 and  relates  to  a DH-s  wing  test  as 
reported  in  McCook  Field  Serial  Report  2391.  The  report  concluded  that  wing  spars  should  have  sufficient 
lateral  bending  strength  to  prevent  a tendency  to  twist  under  some  wing  loading  conditions.  To  prevent 
lateral  spar  failure,  the  strength  requirement  for  the  internal  wing  drag  truss  was  increased  33  percent. 
The  Navy  engineers  disagreed  with  tiiuae  of  the  Army  regarding  the  need  for  the  additional  factors  and 
did  not  adopt  them. 

When  Specification  X-1803  was  issued,  this  and  additional  drag  truss  design  requirements  were 
given  as  part  of  the  Wings  and  Wing  Br.acing  classification  (Figure  4).  To  Insure  torsional  rigidity, 
the  design  requirements  for  Internal  wing  truss  designs  were  increased  as  a function  of  the  wing  typo 
and  ranged  from  a factor  of  1.33  to  3.0.  These  factors  were  used  in  addition  to  the  1.5  factor  of 
safety.  The  change  in  thinking  by  the  Air  Corps,  in  going  from  the  ultimate  V-G  diagram  to  the  design 
load  factor  diagram,  seems  to  be  related  to  a desire  to  standardize  with  the  Navy,  and  a feeling  that 
the  -iddltional  design  factors  would  provide  the  desired  strength.  A possible  third  consideration  may 
have  been  the  Inherent  advantages  associated  with  using  common  envelope  limits  for  both  design  and 
operational  purposes. 

The  Aeronautics  Bulletin  No.  7-A  retained  the  previously  described  factor  of  safety  philosophy  and 
the  implied  value  of  2.0  until  1933.  The  1934  revision  involved  a correlation  of  loading  conditions 
with  actual  flight  conditions  and  it  was  necessary  to  redefine  the  design  or  "ultimate”  load  factor. 

An  "expected"  or  "actual"  load  factor  was  defined  in  conjunction  with  the  ultimate  load  factor  and  a 
factor  of  safety  Tlie  ultimate  load  factor  was  divided  by  the  factor  of  safety  to  obtain  an  "applied" 
load  factor  which  was  not  allowed  to  cause  any  permanent  structural  deformation.  The  actual  stre^igth 
requirement  in  the  1934  issue  of  Bulletin  7-A  stated  that,  "The  minimum  factor  of  safety  for  any  aircraft 
structure  or  component  therefore  shall  be  1.50  unless  otherwise  specified.  This  requires  that  the 
ultimate  strength  of  any  member  shall  be  at  least  1,50  times  as  great  as  its  critical  applied  load" 
(Reference  3b). 

Over  the  years,  some  writers  have  attributed  the  origin  of  the  1.5  factor  of  safety  to  the  character- 
istics of  the  newer  2024  aluminum  (24ST  at  that  time).  It  had  a ratio  of  ultimate  to  yield  stress  of 
approximately  1.5.  Actually,  the  precedent  of  a 1.5  factor  of  safety  (for  design  tall  loads)  had 
already  been  established  when  the  Air  Corps  formally  adopted  it  for  overall  structural  design.  Mr.  Epstein 
has  stated  in  Reference  2c  that  material  properties  were  not  an  Air  Corps  consideration.  If  they  had 
been,  17ST,  which  was  the  aluminum  alloy  used  at  the  time,  would  have  dictated  a factor  of  safety  of 
1.7,  since  it  had  an  ultimate  value  of  55,000  psi  and  a yield  value  of  32,000  psl.  The  corresponding 
value  of  4130  steel  which  was  widely  used  at  the  time  is  1.2.  The  1.5  ratio  for  the  newer  aluminum, 
although  not  a direct  influence  on  the  decision  to  use  a 1.5  value,  did  support  the  selection. 

There  were  also  opinions,  as  noted  by  Hr.  Shanley  in  Reference  3a,  which  attempted  to  relate 
airplane  operation  and  permanent  set  of  the  structure,  or  a lack  of  it,  to  the  selection  of  the  1.5 
factor  of  safety.  This  is  often  cited  as  the  basic  reason  for  the  choice  of  1.5  rather  than  some  other 
number.  The  approximate  1.5  ultimate  to  yield  stress  ratios  of  commonly  used  materials  and  the  apparent 
lack  of  permanent  deformation  appeared  to  mean  that  altplancs  had  not  been  developing  more  than  about 
two-thirds  of  their  design  load  factor  in  flight.  Hr.  Shanley  points  out  that  he  was  not  convinced 
that  the  permanent  set  philosophy  was  a "sound  argument,  for  at  least  two  reasons:  (1)  It  did  not 
apply  to  compressions  members  tlwt  failed  by  buckling,  and  (2)  tension  members  were  alnxjst  always 
critical  at  Joints,  for  which  the  efficiency  was  generally  below  80  percent."  As  previously  cited, 

Mr.  Shanley's  main  reason  for  favoring  a 1.5  factor  was  to  allow  limit  loads  to  remain  relatively  high 
(as  opposed  to  the  assumed  factor  of  safety  of  2.0).  Since  he  also  intcrpieted  limit  load  as  a require- 
ment to  preclude  permanent  act  during  normal  operations,  he  concluded  that  the  only  significance  to  be 
placed  on  the  two-thirds  ratio  was  that  it  Imposed  no  penalty  on  existing  airplanes  when  working  backward 
from  existing  load  factors,  using  a factor  of  safety  of  1.5. 

From  the  point  of  view  of  the  Air  Force,  the  history  of  the  1.5  factor  of  safety  can  best  be 
summarized  by  several  of  Mr.  Epstein's  observations.  In  Reference  2a,  Mr.  Epstein  noted  that  the 
decision  by  the  Air  Corps  to  stipulate  a 1.5  factor  for  subsequent  design  in  conjunction  with  the  V-G 
diagram  was  supported  by,  and  not  Che  result  of,  the  fact  that  the  24ST  Aluminum  alloy  material  then 
coming  into  use  had  a 1.5  ratio  between  ultimate  tensile  and  yield  strength.  He  felt  that  the  adoption 
of  the  1.5  factor  of  safety  was  much  more  significant  (than  any  ceicldcntal  association  with  material 
properties),  in  that,  its  adoption  in  conjunction  with  the  use  of  the  V-G  diagram  recognized  "the 
principle  of  an  airplane  being  limited  operationally  to  a flight  envelope  within  which  it  would  not 
experience  any  significant  permanent  set.” 

He  further  notes  in  Reference  2c  that,  "the  factor  of  safety  of  1.5  has  withstood  many  moves  to 
alter  it,  but  there  was  a period  in  1939  when  the  Chief  of  the  Structures  Branch  of  the  Engineering 
Division  at  Wright  Field  thought  seriously  of  reducing  the  value  of  the  factor.  Newer  aluminum  alloys 
were  becoming  available  with  higher  ratios  of  yield  to  ultimate  strength,  and  he  interpreted  the  factor 
as  the  ratio  of  ultimate  to  yield.  However,  no  action  was  taken  when  the  following  explanation  was 
offered:  'The  factor  of  safety  is  not  a ratio  of  ultimate  to  yield  strength,  but  is  tied  in  with  the 
many  uncertainties  in  airplane  design,  such  as  fatigue,  inaccuracies  in  stress  analysis,  and  variations 
of  material  gages  from  nominal  values.  It  might  also  be  considered  to  provide  on  additional  margin  of 
strength  for  an  airplane  subjected  to  shellfire."* 


Finally,  Mr.  Epstein  notes  In  Reference  la  that,  "In  subsequent  years  there  have  been  various 
assessments  made  as  to  the  significance  of  the  1.5  factor  of  safety  but  actually  its  origin  (in  USAF 
requirements)  was  an  opinion  of  what  was  representative  of  service  flight  operations." 

The  1.5  factor  of  safety  remains  today  in  an  Intermittent  state  of  assessment.  Its  use  in  U.S. 
airplane  design  practice  has  never  been  formally  designated  as  a fixed  design  entity  or  as  a single 
design  entity,  although  it  is  often  viewed  in  that  sense.  Other  Important  structural  design  factors 
affect  safety,  b"t  they  are  normally  viewed  in  a less  rigid  fashion.  Each  factor  that  has  evolved  is 
applied  in  a specific  way.  The  1.5  factor  applies  to  the  basic  external  ground  and  flight  loads  while 
other  supplemental  factors  apply,  for  example,  to  pressurized  cabins,  castings  and  fittings.  The  size 
of  the  safety  factors  selected  usually  depend  on  the  design  application,  manufacturing  standards  and 
the  Intended  operational  use  of  the  airplane  which  existed  at  the  time  they  were  adopted.  Since 
circumstances  change,  a review  of  the  origin  of  each  factor  is  always  of  Interest  and  worthwhile. 

Perhaps  this  review  will  help  place  the  significance  and  future  applicability  of  the  1.5  facto-  of 
safety  in  proper  perspective. 

The  remaining  sections  will  discuss  the  history  of  other  well  known  factots  of  safety  and  variations 
to  the  factor  of  safety  design  concept  from  an  Air  Force  perspective. 


3.  DEVELOPMENT  OF  OTHER  FACTORS  OF  SAFETY 

As  seen  in  the  previous  section,  the  1.5  factor  of  safety  did  not  evolve  as  the  result  of  a concerted 
effort  to  derive  a useful  factor.  It  evolved  together  with  other  design  requirements  as  part  of  an 
overall  desire  to  rationalize  structural  design  criteria.  Other  commonly  used  factors  of  safety  also 
"evolved"  in  a similar,  but  more  direct  fashion  than  did  the  1.5  factor  of  safety  for  airplanes. 

The  history  of  the  1.25  factor  of  safety  for  missiles  as  a requirement  is  relatively  complete. 

The  factor  evolved  as  part  of  an  overall  effort  by  the  Army,  Navy  and  Air  Force  to  develop  strength  and 
rigidity  requirements  for  missiles.  The  derivation  of  the  actual  value  of  1.25  which  finally  evolved 
is  not  as  well  defined,  however,  at  least  with  regard  to  Wright  Field  records.  The  value  seems  to  have 
evolved  through  a philosophical  trial  and  error  process.  Missile  strength  and  rigidity  requirements. 
Including  the  1,23  factor  of  safety,  were  formally  published  by  the  Air  Force  and  the  Navy  in  Specification 
MIL-M-8856  (ASG),  which  was  dated  22  June  1959. 

Missile  design  requirement"  were  actively  pursued  by  both  the  Air  Corps  and  the  Navy  but  they  were 
preceded  by  those  of  the  pilotless  airplane.  In  1945,  the  Air  Corps  compiled  requirements  for  such 
vehicles.  The  document,  "Stress  Analysis  Criteria  for  Winged  Missiles,"  did,  in  effect,  apply  to 
pilotless  airplanes  and  was  derived  from  Specification  C-1803-12.  This  specification  retained  the 
airplane  factor  of  safety  of  1.5.  The  Navy  wrote  a "General  Specification  for  the  Design  and  Construction 
of  Pilotless  Aircraft,"  in  April,  1949.  This  documer.t  was  referred  to  the  Aeronautical  Standards  Group 
(ASG)  by  the  Navy  in  December,  1949.  A letter  from  the  ASG  to  the  Chief  of  Ordinance  (Pentagon), 
recommended  coordination  of  the  specification  with  all  branches  of  the  services. 

In  1952,  a tri-sorvlce  Guided  Missile  Task  Group  was  formed  by  the  Office  of  Standardization, 

Defense  Supply  Management  Agency.  The  task  group  was  composed  of  five  subcommittees,  one  of  which  was 
to  prepare  structural  criteria  and  data  requirements.  This  subcommittee  first  met  in  January,  1953. 

The  Navy  wrote  the  first  draft  of  a guided  missile  strength  and  rigidity  specification  for  the  Criteria 
Subcommittee  in  February,  1953.  This  draft  specification  required  a 1.15  factor  on  yield  strength,  a 
1.5  ultimate  factor  for  loading  conditions  iiazardous  to  personnel  or  to  the  launch  airplane,  and  a 1.0 
ultimate  factor  for  all  other  loading  conditions. 

The  Air  Force,  prior  to  this  time,  had  been  using  a variety  of  ultimate  safety  factors  including 
1.0,  1.15,  1.25,  1.30  for  its  winged  and  ballistic  missiles.  Occasionally,  more  than  one  factor  was 
used  on  the  some  missile  as  occurred  on  the  Matador.  The  ultimate  factor  changed  from  1.15  to  1.25 
between  early  designs  and  the  "B"  model.  At  the  time  the  above  Navy  draft  specification  was  written 
(1953)  the  Air  Force  had  already  Informally  established  the  1.25  ultimate  factor  of  safety  as  a standard 
value  for  missiles.  This  difference  in  Air  Force  and  Navy  factor  of  safety  philosophy  became  very 
evident  by  the  third  meeting  of  the  Criteria  Subcommittee  and  the  factor  of  safety  became  the  most 
controversial  issue  to  be  resolved. 

The  natter  was  "resolved,"  as  noted  in  the  next  draft  specification,  by  deleting  the  use  of  any 
specific  factor  of  safety  and  allowing  each  user  of  the  specification  to  insert  their  own  value.  This 
approach  to  the  factor  of  safety  disagreement  appeared  in  what  was  termed  the  "final  draft"  of  the 
specification  in  June,  1934.  However,  the  actual  finalization  of  the  specification  draft  took  considerably 
longer. 

The  Army  had  initially  participated  with  the  Air  Force  and  Navy  during  the  first  few  meetings  of 
the  committee  but  did  not  attend  after  October,  1953.  The  Army  Ordinance  Corps  felt  that  the  state-of- 
the-art  did  not  warrant  the  Issuance  of  a specification  at  that  time.  They  did,  however,  submit  comments 
on  later  drafts  when  they  were  circulated  for  coordination.  The  committee's  final  draft  did  not  circulate 
for  formal  coordination  until  July,  1955,  and  all  activities  were  terminated  in  March,  1956.  The 
remaining  tri-servlre  coordination  activities  were  assigned  to  the  Navy  Bureau  of  Aeronautics,  Director 
of  Standardization. 

Changes  continued  to  be  made  to  the  "final"  draft  and  several  iterations  ovolved.  In  the  June  and 
December  1952  drafts,  the  factor  jf  safety  wae  reinstated  but  in  a different  form  than  had  been  used 
previously.  A choice  was  given  to  the  user.  He  could  select  factors  of  l.O  yield  and  1.33  ultimate, 
or  1.15  yield  and  no  ultimate  factor.  Wliy  this  choice  of  factors  was  inserted  and  why  the  1.33  was 
selected  is  not  clear  from  available  Air  Force  records,  'fho  1.15  factor  was  a standard  Navy  yield 
design  factor  and  originally  lecommended  for  missile  applications  by  the  Navy,  as  previously  stated. 

The  1.33  value  was  a common  factor  used  for  pressure  vessel  designs,  which  was  a major  design  aspect 

tor  many  missiles.  The  apparent  Intent  was  to  allow  reasonable  design  trades  between  structural  components 

which  were  designed  principally  by  pressure  considerations  and  those  that  were  not. 

A revision  to  the  December,  1957  draft,  dated  September  1958,  revised  that  factor  of  safety  to  1.0 


for  yield  stresses  and  1.25  for  ultimate  stresses.  This  represents  an  apparent  change  in  Navy  design 
philosophy.  The  1.5  ultimate  factor  was  retained  for  handling  and  flight  launch  design  conditions. 

The  December,  1958  draft  and  the  final  published  specification  retained  these  factors  which  are  still 
in  use  today.  Although  hIL-H-8856  was  published  in  final  form  as  an  Air  Force-Navy  specification,  the 
Army  still  retains  an  Interest  in  it  and  Is  kept  Informed  when  revisions  are  made. 

The  most  interesting  aspect  of  the  missile  specification  is  not  the  formal  introduction  of  the 
1.25  factor  of  safety  to  structural  design,  but  the  introduction  of  probabilistic  design  techniques. 

Tne  specification  requirements  stipulated  that  "all  combinations  of  loads  and  loading  conditions  having 
an  acceptable  probability  shall  be  considered."  A specific  requirement  was  included  for  the  design 
limit  incremental  gust  response  on  a reliability  basis.  A probability  of  e>  ;ee..dnce  was  stipulated  for 
the  design  of  air-to-air,  surface-to-surface  and  surface-to-air  missiles.  Str..i  tural  load  responses  to 
gusts  were  to  be  derived  from  the  method  found  in  NACA  TN  4332  (Ref  13)  and  a definition  of  the  atmosphere 
in  power  spectral  density  form  was  taken  from  NACA  Report  1272  (Ref  14).  The  probabilistic  gust  require- 
ments replaced  the  original  discrete  gust  requirements  found  in  early  drafts  of  MIL-M-8856.  The 
earlier  discrete  gust  requirements  were  patterned  after  airplane  requirements  and  were  vigorously 
objected  to  by  the  aircraft  industry.  The  industry  also  emphasized  the  need  for  a common  atmospheric 
description  for  the  design  of  the  structure  and  the  control  system.  Probabilistically  defined  wind  and 
gust  descriptions  were  included  in  the  final  specification. 

In  all,  an  extendeu  period  of  time  was  required  to  develop,  coordinate  and  issue  the  original  MIL- 
M-8856  (ASG)  missile  specification,  but  many  of  the  requirements  were  new  and  never  before  formally  co- 
ordinated between  the  Services. 

.A  related  side  light  is  the  development  of  the  1.4  factor  of  safety  which  is  used  for  manned  space 
vehicles.  This  factor  originated  within  the  Aircraft  Laboratory,  Wright  Air  Development  Center  (WADC). 

The  factor  was  defined  by  the  same  office  responsible  for  all  other  Air  Force  airplane  and  missile 
criteria  (Reference  15).  The  1.4  factor  grew  out  of  a laboratory  study  to  evaluate  the  applicability 
of  tne  1.5  factor  of  safety  for  large  separable  boosters  for  manned  space  vehicles. 

The  Dyna  Soar  (X-20) , manned  maneuverable  reentry  system,  was  under  development  at  the  time  and 
the  booster  systems  were  an  integral  part  of  the  development.  The  manned  glide  re-entry  vehicle  was 
being  designed  by  the  1.5  factor  of  safety,  but  the  factors  applicability  to  the  booster  was  questioned. 
The  laboratory  study  considered  the  usual  design,  construction,  and  manufacturing  limitations  and 
interactions,  but  the  material  properties  provided  the  major  weighting  factor.  The  ultimate  to  yield 
stress  ratios  for  the  two  candidate  Dyna  Soar  booster  materials  were  nearly  identical.  To  maximize 
structural  safety  and  efficiency,  the  material  characteristics  were  reviewed  and  safety  factors  were 
chosen  to  bring  the  design  working  stress  closer  to  the  design  yield  stress.  Because  of  the  uncertainty 
related  to  the  design  of  large.  Integral  pressure  vessles  in  combination  with  flight  loads  and  tempera- 
tures, a 1.1  factor  on  yield  was  selected  in  combination  with  a 1.4  factor  on  ultimate.  The  study 
conclusions  emphasized  that  high  safety  factors  and  high  reliability,  are  not  necessarily  equivalent, 
uor  do  they  negate  the  problems  of  inadequate  design  practice  or  analysis,  ineffective  quality  control 
or  prevent  brittle  material  failures.  The  yield  and  ultimate  factors  were  to  apply  to  all  combined 
aerodynamic.  Inertia,  pressure,  and  thrust  loads  for  both  the  solid  and  liquid  propellent  boosters  then 
being  considered.  The  liquid  booster  propellant  tanks,  however,  when  subject  only  to  pressure  loads, 
were  to  be  designed  to  a 1.2>  ultimate  factor  because  the  internal  pressures  were  considered  more 
predictable  than  those  in  a solid  propellant  booster. 

The  1.4  ultimate  factor  of  safety,  as  initially  developed,  was  Intended  for  a specific  vehicle 
design,  the  X-20  booster.  It  was  not  intended  for  broader  application  or  to  be  used  without  the  1.1 
factor  on  yield  stress.  Its  use  established  a precedent,  however,  and  it  has  since  been  quoted  in  many 
publications.  Presumedly,  the  two  factors  are  still  considered  applicable  to  current  designs,  as  they 
have  since  appeared  in  both  Air  Force  and  NASA  design  requirements  for  manned  space  vehicles. 

Currently,  both  missile  and  space  vehicle  structural  design  philosophies  are  factor  of  safety 
oriented.  However,  the  overall  design  requirements  for  these  vehicles  are  more  closely  related  to  a 
reliability-based  criteria  than  are  current  airplane  designs.  In  the  next  section,  other  basic  concepts 
which  relate  to  both  airplanes  and  missiles  will  be  reviewed.  These  concepts  will  include  modifications 
to  the  conventional  factors  of  safety,  and  certain  reliability-based  criteria  interactions. 


4.  FACTOR  OF  SAFETY  DESIGN  CONCEPTS 

The  desire  to  "rationalize"  design  criteria  Jjas  never  ceased.  Structural  design  requirements 
(Military  Specifications,  for  example)  are  in  a constant  process  of  review  and  revision.  Because  of 
its  encompassing  influence  on  structural  design,  Che  factor  of  safety  has  received  considerable  attention 
in  recent  years.  This  attention,  though,  relates  primarily  to  the  factor  of  safety  as  a design  concept. 
The  specific  value  of  the  factor  of  safety  la  usually  a secondary  consideration.  The  actual  value  does 
not  readily  equate  to  a specific  level  of  safety,  and  it  is  difficult  Co  judge  the  difference  ir  safety 
as  related  by  a clwnge  in  factor  from  1.5  to  1.4,  for  example.  Similarly,  the  factor  of  safety  concept 
does  not  readily  equate  to  an  identifiable  design  objective  that  provides  or  defines  structural  Integrity. 
Integrity  is  achieved  through  many  Interacting  design  facets,  some  of  which  are  obvious  and  some  abstract. 
The  concept  primarily  provides  a "safe"  operating  margin  between  an  operational  and  design  level  of 
strength.  Just  how  "safe"  this  margin  makes  the  airplane  is  always  open  to  question  because  of  numerous 
unknowns  and  parameter  variations  which  affect  structural  loads,  design,  analysis,  materials,  operation, 
and  the  natural  environment.  Because  of  these  unknowns  and  variations,  the  actual  deg  ee  of  structural 
optimization  achieved  is  also  questionable.  The  apparent  high  degree  of  structural  integrity  achieved 
tf  the  factor  of  safety  concept  is  often  the  result  of  indirect,  intuitive  considerations  and  reactions 
to  previous  problems.  Design  and  operational  experience  has  essentially  provided  the  basis  for  the 
"acceptability"  of  current  requirements  and  the  "safety"  provided  by  the  factor  of  safety  concept.  To 
overcome  this  apparent  lack  of  precision,  definition  and  objectivity  and  improved  design  flexibility, 
the  use  of  probabilistic  techniques  and  reliability-based  design  criteria  are  often  proposed. 

Having  reviewed  the  history  of  several  well  known  factors  of  safety  for  airplane  and  missile 
design  In  Section  ll  and  III,  we  can  now  review  a number  of  Air  Force  studies  of  variations  to  these 
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factors  and  note  their  Influence  on  current  design  practice.  These  variations  to  current  factor  of 
safety  design  concepts  tend  to  blend  with  reliability-based  concepts.  One  effectively  leads  to  the 
other  because  some  of  the  variations  are  an  attempt  to  "rationalize"  criteria  and  are  Intended  to  be  a 
step  toward  a reliability-based  criteria. 

The  operational  environment  has  become  Increasingly  hostile,  and  more  and  isore  demands  are  made  of 
the  airframe.  To  Improve  airplane  performance  and  accurately  appraise  structural  design  requirements, 
established  criteria  must  be  continuously  updated  and  supported  by  adequate  technology.  The  technical 
support  must  Include  analytical  techniques  for  determining  aerodynamic  derivatives,  vehicle  dynamics, 
heat  tiansfcr,  stress-temperature  distributions,  material  properties  after  prior  random  exposures,  a 
suitable  means  of  qualifying  a structure  to  actual  or  reasonably  representative  environments,  and  a 
satisfactory  means  of  flight  test  demonstration.  Regardless  of  the  design  concept,  the  parameters  that 
affect  the  structure  and  its  response  must  be  further  explored.  A realistic  appraisal  of  our  current 
ability  to  guarantee  the  design  of  a reliable  structure  and  to  define  the  steps  required  to  obtain  a 
reasona'-'le  assurance  of  structural  reliability  Is  also  required  (Reference  16). 

Statistics  have  formed  a basic  part  of  airplane  criteria  from  the  time  that  sufficient  data  were 
available  to  judge  the  reasonableness  of  values  used  for  maneuver  load  factor  and  design  gust  (Refer- 
ence 16).  Material  properties,  sink  speeds  and  other  parameters  used  for  estimating  fatigue  life  are 
also  derived  statistically.  However,  all  current  requirements  for  static  strength  call  for  a specific 
factor  of  safety  to  be  applied  to  maximum  expected  loads  even  though  some  of  the  design  parameters  and 
resulting  loads  were  statistically  derived. 

For  about  two  decades,  which  span  the  1950' s and  1960’s,  two  additional  design  concepts,  "safe- 
life"  and  "fall-safe,"  have  been  used  in  combination  with  the  factor  of  safety  to  design  military 
airplanes  for  the  fatigue  or  repeated  load  environment.  Chief  emphasis  has  been  placed  on  the  factor 
of  safety  and  safe-life  approaches.  The  fall-safe  concept  is  added  to  a design  when  high  reliability 
Is  required  (as  in  transport  airplanes)  or  when  performance  penalties  are  not  Incurred  (as  In  fighter 
airplanes).  The  safe-life  concept  attempts  to  Identify,  through  analysis  and  test,  the  fatigue  critical 
areas  of  the  airframe  and  off-set  problems  which  might  occur  within  the  specified  llfe-tlme  of  the 
airplane.  This  presents  a "conflict"  between  the  non-probabllistlc  factor  of  safety  concept  and  the 
probabilistic  concept  of  safe,  service  life.  Faced  with  an  Increasingly  complex  operating  environment 
and  a demand  for  more  reliable  (economical)  airframes,  the  designer  has  attempted  to  make  the  most  of 
each  concept.  The  factor-of-safety,  a static  strength  parameter,  will  not  provide  for  time  varying 
affects,  and  Che  safe-life  concept  suffers  from  a lack  of  appropriate  operational  and  structural  component 
test  data.  Therefore,  the  task  of  designing  a reliable  structure  has  been  to  incorporate  analysis 
methods  which  combine  the  useful  functions  of  each  concept  (Reference  17). 

More  recently  the  term  of  "safe-life"  has  become  obsolete  and  the  terms  "damage  tolerance"  and 
"durability"  have  been  Introduced.  The  design  Intent  to  provide  structures  that  are  safe  and  economical 
to  maintain  has  not  clianged  but  the  approach  Is  different.  The  current  Air  Force  design  philosophy 
emphasizes  both  the  damage  resistance  or  tolerance  to  manufacturing  or  service  Induced  flaws  for  some 
specified  period  of  service  usage  and  the  economical  malntalnance  of  the  airframe. 

The  term  damage  tolerance  Is  not  new,  but  the  emphasis  on  assumed  Initial  or  service  Induced  flaws 
In  the  airframe  is  relatively  new.  The  damage  tolerance  concept  Is  Intended  to  minimize  catastrophic 
structural  failures  due  to  the  propogatlon  of  undetected  flaws  in  critical  locations.  To  contain  the 
damage,  fall-safe  and  slow  crack  growth  design  concepts  are  used.  The  fall-safe  concept  contains  local 
damage  by  use  of  multiple  load  paths  and  tear  stoppers.  The  slow  crack  growth  concept  protects  safety 
by  not  permitting  flaws  to  grow  through  unstable  rapid  propagation.  This  Is  done  through  Inspections, 
or  life  limiting  In  the  case  of  non-lnspectable  structure. 

The  durability  requirements  emphasize  low  maintenance  costs  during  the  life  of  the  airframe.  The 
durability  concept  Is  Intended  to  minimize  airframe  maintenance  due  to  cracks  and  related  structural 
degradation.  The  safe-life  concept  used  a factor  of  4.0  In  predicting  fatigue  life  and  was  a ccmblned 
deterministic/probabilistic  concept.  In  essence,  the  damage  tolerance  concept  (which  does  not  use  a 
directly  applied  factor)  can  be  considered  as  deterministic  as  the  safe-life  concept  because  the  stipulated 
Initial  flaws  are  In  fact,  factors  of  safety  on  time. 

The  most  argued  "advantage"  for  reducing  the  factor  of  safety  is  the  reduction  in  airplane  weight 
and  the  accompanying  Increase  In  performance.  An  Impressive  discussion  in  favor  of  reducing  the  factor 
of  safety  to  save  weight  Is  provided  in  Reference  18,  which  was  written  In  1954.  The  discussion  considers 
permanent  set,  allowance  for  defects  in  material  and  workmanship,  stiffness,  and  maneuver  load  exceedances. 
Proper  accounting  of  these  points  during  design  Is  shown  to  support  a decrease  In  airplane  weight.  The 
arguments  seem  factual  and  arc  still  current.  Some  facets  can  be  updated  to  todays  design  philosophies 
and  technology  to  further  support  the  contentions  given.  The  advantages  to  reducing  the  factor  of 
safety  arc  shown  by  decreases  la  gross  weight  as  a function  of  factor  size  and  proportionate  Increases 
In  performance  for  representative  military  airplanes.  Of  special  Interest  Is  the  note  that  airplanes 
frequently  exceed  design  limit  load  factors  and  that  such  factors  may  require  an  increase,  rather  than 
continuing  to  count  on  the  1.5  factor  of  safety  to  cover  such  occurrences.  The  projected  control  of 
limit  load  factor  exceedances  by  the  use  of  entirely  automatic  flight  control  systems  has  not  materialized 
for  piloted  airplanes  but  Is  quite  common  for  missiles  and  space  craft. 

Reference  18  also  points  out  the  erroneous  Idea  that  the  1.5  factor  of  safety  always  provides  an 
actual  operational  level  of  strength  SO  percent  above  limit  load  factor.  Structural  design  procedures 
assume  a linear  load  increase  between  limit  and  ultimate  load  when  the  1.5  factor  of  safety  is  used. 

Due  to  aerodynamic  nonllncarltics,  some  parts  of  the  airplane  roach  loading  conditions  greater  or  loss 
than  1.5  times  the  limit  load  when  the  airplane  achieves  ultimate  load  factor.  Operational  conditions 
and  related  design  requirements  also  Impose  different  strength  requirements  on  specific  components  at 
different  times.  For  any  one  design  condition  there  will  be  an  "Imbalance"  of  strength  distribution 
throughout  the  airframe.  This  can  bo  minimized  but  cost,  schedules  and  the  lack  of  appropriate  aerodynamic 
load  data  early  in  design  often  hinder  the  development  of  a more  efficient,  or  "balanced"  airframe. 

Then,  again,  there  arc  many  unknowns  regarding  the  Influence  that  a weight  reduction  program  may  have 
on  the  airframe  In  later  years,  or  If  the  weight  savings  will  significantly  improve  performance  and 
reduce  operational  costs. 

The  significance  of  reducing  airframe  weight  fractions  below  current  averages  in  terms  of  performance. 


lifetime  operational  costs,  and  structural  maintenance,  is  difficult  to  evaluate.  System  dependency, 
the  initial  level  of  structural  design  conservatism,  the  Increasing  severity  of  operational  environments, 
and  damage  tolerance  design  requirements  further  complicate  the  evaluation.  Factual  design  inter- 
actions can  be  established  best  when  oeslgn  flexibility  is  highest,  early  in  design.  Yet,  factual 
design  and  operational  usage  data  are  normally  not  well  defined  early  in  de.«lgn.  Weight  reduction 
programs  are  often  conducted  "after  the  fact,"  concentrate  too  heavily  on  reducing  only  airframe  weight, 
and  minimally  evaluate  the  many  ocher  less  prominent  but  Important  performance  and  design  interactions. 
Although  cost  saving.3  are  often  correlated  with  airframe  weight,  the  probability  of  actually  realizing 
the  theoretical  savings  shown,  or  projecting  the  impact  of  the  "savings"  on  structural  maintenance  and 
reliability,  arc  seldom  evaluated.  Many  of  todays  aerodynamically  efficient  airplanes  are  volume 
limited,  rather  than  weight  limited,  when  loaded.  Hence,  the  airframe  weight  saved  does  net  necessarily 
provide  a performance  or  oper.ational  advantage  and  could  possibly  be  put  to  better  use  by  improving  the 
durability  of  the  airframe.  Unfortunately,  very  little  factual  data  is  available  to  accurately  weigh 
the  validity  of  these  points. 

Any  change  in  structural  weight  is  further  reflected  as  an  even  larger  change  in  gross  weight. 

This  relationship  is  described  by  a "weight  growth"  factor  which  is  the  ratio  of  the  delta  change  in 
gross  weight  for  each  one  pound  change  in  structural  weight.  A certain  range  or  value  of  weight  growth 
factor  can  be  used  to  describe  an  airplane  category  (transport,  fighter,  or  bomber)  but  a specific 
factor  must  be  calculated  for  each  airplane  to  be  accurate.  Although  airframe  weight  trends  have  not 
varied  significantly  in  recent  years,  weight  growth  factors  have  been  decreasing  and  the  overall  sensitivity 
of  airplane  performance  and  operating  costs  versus  structural  weight  have  also  been  decreasing.  The 
reasons  for  the  cliange  in  sensitivity  are  related  to  technological  Improvements.  These  improvements 
Include  the  use  of  more  efficient  materials  and  construction  tecnnlques,  greater  aerodynamic  and 
propulsion  efficiencies,  and  higher  internal  packaging  densities.  Conversely,  the  structural  weight 
trends  (as  described  in  Reference  Ih)  show  an  insensitivity  to  higher  strength  to  weight  materials  and 
related  structural  improvements.  Apparently,  increases  in  structural  efficiency  are  offset  by  the 
imposition  of  more  severe  design  and  operational  requirements. 

The  Influence  of  current  structural  design  concepts  and  packaging  density  can  be  illustrated  by 
reviewing  the  wing  content  and  structure  of  a current  fighter  airplane.  The  installed  wing  structure 
weighs  about  1800  pounds.  The  primary  wing  bending  strength  is  derived  from  the  upper  and  lower  wing 
box  skins  which  weight  about  735  pounds.  A factor  of  safety  change  would  have  the  largest  impact  on 
the  wing  skins  which  comprise  about  40%  of  the  total  installed  wing  structural  weight.  A large  peicentage 
of  the  total  wing  weight  is  composed  of  the  flaps,  actuators,  and  seals.  These  and  other  miscellaneous 
components  would  not  be  greatly  affected  by  a change  in  the  structural  factor  of  safety. 

Recent  examples  of  the  factor  of  safety's  influence  on  airframe  weight  have  resulted  from  an 
unofficial  Ait  Force  deslg.i  philosophy  for  experimental  or  prototype  vehicles.  The  unofficial  philosophy 
modifies  the  normal  airplane  development  cycle  which  includes  a series  of  ground  and  flight  tests  to 
validate  airframe  integrity.  Initial  flight  tests  are  normally  restricted  to  80  percent  of  certain 
design  maneuver  load  levels,  until  ground  static  tests  are  completed  to  ultimate  load  levels.  Flight 
test  airplanes  are  normally  Instrumented  and  critical  load  points  are  closely  monitored.  Flight  and 
ground  test  loads  are  then  cort elated  and  ground  tests  are  repeated,  if  necessary,  to  further  validate 
the  structure  for  the  actual  flight  loads  before  the  airplane  is  released  to  fly  at  100  percent  of 
design  limit  load.  Such  testing  is  complicated,  expensive  and  time  consuming.  Although  justifiable 
for  an  airplane  system,  when  structural  efficiency  must  be  optimized,  experimental  and  prototype  vehicles 
cannot  be  as  rigorously  tested  because  of  cost  and  time  constraints.  To  insure  equal  flight  safety  at 
100  percent  of  design  limit  load,  without  the  extensive  testing  and  associated  delays,  the  following 
procedure  has  been  established: 

a.  The  new  experlmental/protutype  airframe  or  modifications  to  existing  airframes  are  designed 
using  a 1.875  factor  of  safety  on  loads,  which  is  equivalent  to  a theoretical  msrgin  of  safety  of 

+0.25.  The  Initial  80  percent  flight  restriction  normally  Imposed  on  an  airplane  system  is  also  equivalent 
to  a +0.25  margin  of  safety. 

b.  The  experimental/prototype  airframe  is  stress  Instrumented  at  critical  design  points  and 
proof  tested  on  the  ground  to  110  percent  of  design  limit  load,  to  Insure  deslgii/manuCacturing  integrity. 

The  installed  Instrumentation  is  further  monitored  in  flight  and  compared  tc  the  proof  load  results  as 

a further  safety  check. 

If  this  design  procedure  is  used,  the  airplane  is  allowed  to  fly  at  100  percent  of  design  limit 
load  capability  without  an  ultimate  load  ground  teat  and  without  reducing  overall  safety.  Actually, 
the  !.875  factor  and  110  percent  proof  load  test  provides  a larger  ultimate/limit  ratio  (1.7)  than  the 
conventional  ratio  (1.5).  Therefore,  testing  to  110  percent  of  limit  load  is  less  likely  to  cause 
detrimental  yielding  of  the  airframe  than  conventional  testing  to  100  percent  of  limit  load.  For  the 
experimontal/prototype  vehicle,  the  philosophy  imposes  no  real  penalty  because  of  its  "one-of-a-kind" 
nature  and  flexible  mission  status.  Two  examples  of  this  philosophy  will  be  discussed  in  the  following 
paragraphs. 

The  first  example  is  a prototype  Mach  2 fighter  airplane  design  wlilch  emphasized  exceptional 
maneuverability  and  typical  mission  objectives.  This  prototype  design  was  to  bo  built  and  used  as  a 
technology  advancement  demonstrator i the  design  was  completed  but  manuiacturing  plans  were  cancelled. 

The  technology  objectives  lave  been  rechannclcd  to  an  existing  airplane  which  will  be  modified  instead. 
During  the  design  of  the  proposed  demonstrator,  a dual  airframe  comparison  was  made  using  the  1.5  and 
1.875  factors.  The  comparison  evolved  as  follows: 

a.  The  design  requirement  specified  the  use  of  a 1.875  factor  for  flight  loads.  Computerized 
design  techniques  and  a highly  detailed  finite  element  structural  model  were  used.  The  available 
deHlgn/analyslo  flexibility  allowed  the  weight  of  the  airplane  and  airframe  to  be  established  separately 
for  both  the  1.5  and  1.875  factors. 

t.  Two  weight  comparisons  were  then  established:  (1)  The  airplane  gross  takeoff  weight 
using  the  1.5  factor  was  26,465  pounds.  Using  the  1.875  factor  it  weighed  27,056  pounds,  or  an  increase 
of  2.2  percent.  (2)  The  structural  weight  using  the  1.5  factor  was  5,095  pounds.  For  the  1.875  factor, 
it  was  5,433  pounds,  or  an  increase  of  6.2  percent.  These  weights  reflect  a design  service  life  of 
12,000  hours  (a  service  life  of  3,000  hours  and  a scatter  factor  of  4.0). 
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Th<i  weight  growth  factor  was  calculated  to  be  1.75  (pounds  gross  weight  increase  for  each  pound  of 
structural  weight),  which  is  a reasonable  value  for  a fighter  airplane. 

The  second  example  is  the  YF-16  prototype  airplane.  The  1.875  factor  was  applied  to  the  flight 
loads  and  increased  the  structural  weight  by  6.6  percent  when  compared  to  the  1.5  factor.  The  weight 
increase  has  not  been  detrimental  to  its  overall  performance  and  would  be  further  minimized  if  the 
1,000  hour  design  service  life  of  Che  prototype  airplane  were  Increased.  The  weight  increment  caused 
by  the  larger  factor  to  safety  would  be  partly  absorbed  by  the  weight  increase  required  to  meet  the 
service  life  requirements. 

Using  the  same  design  analogy,  a comparison  of  the  weight  increase  required  for  different  service 
lives  can  be  seen  in  another  design  study  of  a fighter  technology  demonstrator  of  the  same  weight 
class.  For  a 1.875  factor  of  safety  and  a scatter  factor  of  4.0,  the  airframe  delta  weight  increased 

about  25  pounds  per  1,000  hours  of  service  life.  Because  of  the  1.875  factor,  no  additional  weight  was 

required  to  achieve  th;  first  1,500  hours.  Damage  tolerance  requirements  were  not  applied  during  this 
study  but  they  would  have  further  influenced  the  airframe  weight,  increasing  it  to  some  degree.  Similarly, 
the  1.875  factor  would  have  lessened  the  weight  sensitivity  of  the  airframe  to  these  requirements. 

If,  instead  of  increasing  the  margin  of  safety  by  25  percent,  it  were  decreased  by  tne  same  amount, 
a similar  airframe  delta  weight  could  be  expected  for  the  technology  demonstrator.  As  noted  in  Figure  5, 
which  is  based  on  the  first  example,  the  factor  of  safety  equivalent  to  the  25  percent  margin  of  safety 

reduction  is  1.125.  The  use  of  this  ''small"  factor,  when  compared  to  the  1.50  nominal  factor,  would 

probably  not  be  considered  by  a designer  even  if  a large  reduction  in  airframe  weight  were  desired. 

The  airframe  weight  reduction  shown  (6.2  percent)  may  be  optimistic  because  the  normal  damage  toler- 
ance/fatigue  life  requirements  are  not  incorporated.  A 1.25  factor  of  safety  is  perhaps  a more  reasonable 
value  to  choose  and  is  shown  for  comparison.  It  would  provide  an  approximate  4 percent  weight  saving 
and  a 16.7  percent  reduction  in  margin  of  safety.  These  percentage  weight  changes  and  margins  of 
safety  are  reasonable  and  reflect  current  Jet  fighter  design  technology  trends.  Similar  data  can  be 
found  for  other  airplane  types  in  References  18  and  20. 

Reference  18  reflects  technology  of  the  1950' s but  the  trends  are  still  applicable.  Data  is  given 
for  fighter,  bomber  and  transport  airplanes  and  factors  of  safety  between  1.0  and  1.5.  The  average 
structural  weight  saving  shown  for  the  three  airplane  types  using  a factor  of  safety  of  1.4  would  be 
2.5  (+0.25)  percent  as  compared  to  a 1.5  factor.  If  a 1.25  factor  of  safety  were  compared  to  a 1.5 
factor,  the  average  structural  weight  saving  would  be  5.0  (+0.75)  percent.  Although  these  structural 
weight  trends  are  still  current,  the  range  and  gross  weight  trends  in  Reference  18  do  not  represent 
today's  airplanes  as  well.  The  range  Increases  shown  for  the  lower  structural  weights  assumed  a weight 
growth  factor  of  seven  for  all  three  airplane  types  and  additional  fuel  was  substituted  for  the  gross 
take-off  weight  "saved."  Using  these  assumptions,  jet  fighters  are  shown,  for  example,  to  yield  a 15 
percent  range  increase  and  jet  bombers  a 5 percent  range  increase  or  an  average  of  10  percent  for  both 
airplanes.  These  range  increases  are  oased  on  a gross  take-off  weight  and  fuel  adjustment  that  averages 
15  (+3.5)  percent  when  a 1.25  factor  o'-  safety  is  used.  These  gross  weight  and  fuel  adjustments  would 
average  6 (+1.25)  percent  when  a i.«0  factor  or  safety  is  used. 

The  weight  growth  factor  of  seven  and  the  substitution  of  fuel  for  gross  weight  "saved"  will  give 
optimistic  gross  weight  decreases  and  range  increases  today,  since  weight  growth  factors  are  less. 

Factors  in  past  years  for  airplanes  have  ranged  from  about  five  to  ten.  The  weight  growth  factor  for  a 
fighter  today  would  be  about  two  Instead  of  seven  and  for  long  range  airplanes  like  bombers  and  transports 
a value  of  five  would  be  appropriate.  To  Illustrate,  the  trend  in  Reference  18  for  a fighter  and  a 
weight  growth  factor  of  7 gives  a gross  weight  savings  of  17  percent  for  a factor  of  safety  of  1.25. 

The  fighter  technology  demonstrator  study  gives  a gross  weight  savings  of  2.4  percent  for  a factor  of 
safety  of  1.25  and  a growth  factor  of  1.75.  For  the  same  factors.  Reference  18  gives  a gross  weight 

savings  of  13  percent  for  a bomber  as  compared  to  6 percent  in  Reference  20,  which  used  a growth  factor 

of  5.50.  These  are  only  trends,  however,  and  they  are  debatable,  since  weight  estimating  and  the 
establishment  of  weight  growth  factors  is  a sensitive  art.  To  establish  accurate  values,  the  factors 
must  be  based  on  a detailed  evaluation  of  a specific  airplane  and  its  basic  missions. 

Reference  20  presents  a simplified  but  constructive  parametric  study  of  the  factor  of  sefety. 

Three  different  vehicle  types  were  selected  and  designed  using  a range  of  ultimate  factors  of  safety. 

For  comparison,  three  other  structural  design  concepts  were  Included:  the  modified  factor  of  safety 
concept  defined  in  Reference  21,  Part  1;  a yield  factor  of  safety  concept;  and  a reliability-based 
concept . 

The  conventional  factor  of  safety  was  applied  to  the  limit  design  loads  of  each  vehicle  in  inci-ements 
between  1.0  and  2.0.  The  modified  factor  of  safety  concept  applied  a factor  of  1.05  to  speed.  1.15  to 

maneuverability  and  1.10  to  design  loads.  A yield  philosophy  applied  factors  of  1.0  and  1.10  to  design 

limit  loads. 

The  demonstration  included  cruise,  ballistic  and  glide  re-entry  type  vehicles.  Alrhou’h  hypothetical 
mission  profiles  and  performance  figures  were  used,  they  were  patterned  after  real  vehicles  and  designed 
to  realistic  structural  requirements.  The  structural  concepts  used  were  monocooue,  seml-monocoque, 
truss,  pressure  stabilized  and  sandwich  honeycomb.  Two  structural  concepts  were  apilled  to  each  vehicle, 
as  appropriate  to  the  vehicle  type,  and  radiating  and  ublatlve  thermal  protection  sy.atems  were  applied 
separately  to  the  re-entry  vehicle. 

The  conventional  factor  of  safety  philosophy  normally  considers  only  one  factor  to  establish 
ultimate  deaign  loads,  without  regarding  the  variables  contributing  to  the  limit  reads.  The  yield 
design  philosophy  uses  a single  factor  of  safety  to  prevent  the  design  limit  stresses  from  exceeding 
ihe  material  yield  stress;  an  ultimate  load  factor  Is  not  used.  X'ne  modified  factor  of  safety  philosophy 
also  applies  a factor  to  the  design  limit  loads,  but  these  loads  are  first  cstalliohed  by  ‘'actoring  two 
performance  parameters,  as  previously  noted. 

A reliability  based  design  philosophy  normally  considers  the  statistical  distribution  and  the 
probability  of  the  combined  occurrence  of  a finite  number  of  structural  design  factors  in  order  to 
establish  design  loads.  In  reference  20,  the  various  factor  of  safety  denlgn  philosophlee  were  also 
compared  to  a otructural  reliability  value.  The  reliability  vaiue  was  establlsned  by  considering  the 
statistical  distributions  and  the  simultaneous  occurrence  of  two  statistically  varianc  design  factors. 


The  parametric  study  considered  both  rigid  and  flexible  structure  and  aerodynamic  heating  effects 
when  applicable.  Weight,  weight  distribution,  and  stiffness  characteristics  were  determined  for  each 
major  component.  These  parameter  variations  were  correlated  to  each  vehicle's  performance  and  structural 
reliability. 

The  scope  of  the  investigation  can  be  considered  limited,  in  that,  the  structural  concepts  used 
were  simplified,  the  analysis  methods  were  not  elaborate,  and  only  one  critical  design  point  was  selected 
for  each  vehicle.  However,  structural  weights  were  optimized,  the  effects  of  plasticity  were  accounted 
for,  and  interaction  equations  were  used  to  account  for  local  and  general  instabilities  caused  by 
combined  loading. 

The  cruise  vehicle  design  is  similar  to  a B-52  bomber  in  performance,  size,  weight,  and  structural 
flexibility.  Gust  and  maneuver  were  the  critical  design  conditions.  These  two-parameters  formed  the 
loading  interaction  curves  used  to  establish  an  equivalent  reliability-based  design,  as  shown  in  Figure  6. 
By  using  available  gust  and  maneuver  statistics,  the  must  probable  combination  of  the  two  design  parameters 
that  could  cause  structural  failure  at  each  strength  level  were  located  on  the  interaction  envelopes, 
as  shown  in  Figure  7.  Although  not  an  optimum  design,  considering  the  complexity  of  other  reliability- 
based  concepts,  the  most  probable  failure  point  is  used  to  illustrate  that  a lighter  structure  can  be 
achieved  by  a reliability-based  concept,  as  compared  to  a factor  of  safety  concept,  even  though  both 
provide  the  same  (theoretical)  reliability. 

The  weight  reduction  for  the  equally  reliable  design  is  achieved  by  bringing  the  strength  of  the 
individual  components  closer  together.  This  is  similar  to  using  different  factors  of  safety  to  contour 
the  shape  of  the  interaction  curves  of  overstrength  components  to  fit  the  shape  of  the  composite  failure 
boundary  of  the  vehicle.  This  caxes  advantage  of  the  fact  emphasized  in  Reference  18,  that  all  components 
do  not  reach  150  percent  of  limit  load  simultaneously.  Part  of  the  study  results  for  the  cruise  vehicle 
are  shown  in  Figure  8, 

The  range  Increases  shown  in  Figure  8 are  the  result  of  decreases  in  the  inert  (empty)  weight  of 
the  vehicle.  The  ratio  of  inert  weight  change  to  structural  weight  change  is  about  2.0  and  the  growth 
factor  between  structure!  weight  change  and  gross  take-off  weight  change  is  about  5-5.  The  decrease  in 
inert  weight  due  to  the  structural  weight  change,  for  example,  when  using  a 1.25  factor  of  safety  is 
about  11  percent,  which  increases  the  range  1.6  percent.  The  dramatic  performance  Increases  often  seen 
in  such  comparisons  is  not  seen  here  because  of  the  more  realistic  value  of  the  weight  growth  factor. 

The  substitution  of  fuel  for  either  the  inert  or  gross  weight  saved,  although  a fuel  substitution  for 
inert  weight  saved  is  shown,  is  not  considered  a realistic  design  trade.  The  performance  of  a specific 
airplane  design  is  normally  optimized  using  available  fuel  volume;  any  additional  structural  weight 
saved  as  a result  of  a concerted  weight  reduction  program  would  normally  enhance  the  performance  based 
on  the  original  fuel  volume.  Independently  of  additional  fuel. 

Fatigue  life  and  flutter  were  not  design  considerations  in  Reference  20  and  their  interactions 
are  unknown.  Similarly,  the  probabilities  shown  in  Figure  13  are  based  only  on  the  interaction  of  gust 
and  maneuver  loads  and  do  not  consider  other  facets  such  as  material  properties  and  workmanship  that 
would  also  affect  the  structural  reliability. 

The  gross  trends  established  in  Reference  20  should  not  be  significantly  affected  by  the  limited 
scope  of  the  study  and  the  use  of  simplified  structural  models.  As  a general  trend,  the  rellablllty- 
besed  design  concept  provided  a lower  structural  weight  and  better  performance  than  did  the  factor  of 
safety  concept  having  an  equal  reliability.  The  modified  factor  of  safety  concept  gave  results  closer 
to  the  reliability-based  concept  using  two  parameters  than  did  the  single  factor  of  safety  used  to 
obtain  the  ultimate  design  loads. 

Theoretically,  a higher  confidence  can  be  placed  in  a structure  designed  by  a reliability  concept 
than  by  a factor  of  safety  concept  because  the  actual  reliability  of  the  factor  of  safety  design  is 
never  known.  The  reliability-based  concept,  by  contrast,  considers  the  statistical  nature  of  the 
design  parameters  and  thus  acquires  a known  reliability  and  the  associated  confidence  level  of  the 
statistical  data  used.  In  a practical  sense,  however,  this  is  not  true  because  the  design  parameters 
are  not  well  defined  and  the  actual  reliability  of  the  structure  cannot  be  authenticated. 

The  modified  factor  of  safety  concept,  as  incorporated  In  the  comparative  factor  of  safety  study 
in  Reference  20,  is  documented  in  Reference  21,  Part  1.  The  concept  was  developed  as  an  interlum 
design  method  to  be  used  until  a larger  number  of  parameters  could  be  defined  and  a formal  reliability- 
based  concept  established.  In  Reference  21,  forty-one  design  parameters  are  described  as  significant 
to  a reliability-based  structural  design  concept.  Fifteen  are  related  to  the  design  environment  and 
operating  conditions.  The  related  analysis  parameters  are:  aerodynamic  forces,  propulsion  system 
forces  and  pressures,  material  properties  and  property  variations,  thermal  stresses,  creep  of  materials, 
weight  and  weight  distribution,  compocunt  misalignments,  construction,  propulsion  system  thi.ust  misalign- 
ments, aero-elasticity  and  aerothermoelasticity,  buffeting,  flutter,  shock  and  vibration,  workmanship, 
fatigue,  noise,  fuel  sloshing  and  surging,  structural  temperature,  ablation,  corrosion,  oxidation,  and 
erosion. 

As  a concept,  the  modified  factor  of  safety  can  be  applied  to  any  vehicle  design  but  it  was  originally 
developed  for  missile  design  application.  The  use  of  three  parameters  seemed  feasible  within  the 
current  state-of-the-art  and  the  concept  is  considered  to  be  more  "rational"  than  the  ultimate  factor 
of  safety  concept  because  it  recognizes  parameters  other  than  load  as  significantly  affecting  struc- 
tural integrity  and  reliability.  Although  the  structural  reliability  of  a missile  design  using  the 
1.25  factor  of  safety  could  not  be  given  a numerical  value,  the  reliability  seemed  high,  and  Che  three 
factors  selected  (1.05  on  speed,  1.10  on  loads  or  "quality,"  and  1.15  on  maneuverability)  were  chosen 
to  give  a combined  strength  affect  similar  to  that  provided  by  the  1.25  factor.  The  1.05  factor  on 
speed  is  significant  because,  for  some  missiles,  small  increases  in  speed  result  in  rapid  degradation 
in  structural  capacity  due  to  material  degradation  with  rising  temperature.  Thus,  with  the  initial 
design  based  on  a higher  speed  (and  hence  higher  temperature)  the  designer  is  forced  to  avoid  the  use 
of  materials  which  arc  unduly  sensitive  to  te,mpcraCures . The  1.10  "quality"  factor  is  applied  to  the 
structural  loads  incurred  at  specified  "maximum”  design  conditions  rather  chan  at  conventionally 
defined  "limit"  conditions.  This  concept  more  rationally  accounts  for  the  nonlinearities  in  aeroelasclc 
and  aerodynamic  data  that  frequently  occur  between  limit  and  ultimate  (design)  conditions.  The  1.15 
factor  is  applied  to  the  maneuver  load  factor  to  protect  the  vehicle  from  inadvertent  maneuver  exceedances. 
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The  modified  factoi  of  safety  concept  was  used  to  design  the  ASSET  glide  re-entry  vehicles.  ASSET 
is  an  acronym  for  Aerothermodynamic/elastic  Structural  Systems  Environmental  Tests.  The  ASSET  program 
consisted  of  designing  and  flying  a series  of  winged  glide  re-entry  vehicles  which  were  boosted  into 
sub-orbital  flight  paths.  Each  vehicle  was  designed  to  explore  an  area  of  glide  re-entry  technology 
that  could  not  be  defined  in  existing  ground  test  facilities.  Structural  flight  test  results  and  data 
correlations  which  substantiate  the  adequacy  of  the  design  concept,  at  least  for  vehicles  having  a 
programmed  trajectory,  is  given  in  Reference  22. 

For  an  airframe  that  is  not  aerodynamically  heated,  the  "load  factor"  parameter  is  usually  sufficient 
to  convey  its  overall  strength  capability.  With  the  introduction  of  transient  stresses  and  reduced 
material  properties  due  to  thermal  gradients,  there  is  no  simple  method  for  conveying  strength  capability 
(Reference  24) . Although  a "thermal  factor  of  safety"  is  net  necessarily  a "true"  factor  of  safety  in 
the  conventional  sense,  it  represents  a design  concept  that  is  Intended  to  provide  an  equivalent  measure 
of  conservatism  and  confidence  in  the  heated  airframe  as  that  provided  by  the  conventional  factor  of 
safety  in  the  cold  airframe. 

To  date,  unofficial  Air  Force  policy  has  been  to  avoid  using  any  factor  on  temperature,  or  heat 
transfer,  or  on  time  at  temperature  for  airplanes.  This  has  been  a reasonable  policy,  since  service 
experience  has  demonstrated  that  there  is  little  problem  in  keeping  within  a speed-altitude  design 
envelope.  Thus,  in  a sense,  the  temperatures  normally  used  for  design  represent  the  actual  maximum  to 
be  expected  for  the  structure.  This  philosophy  of  not  factoring  tejaperature  is  an  apparent  contradiction 
when  compared  to  the  philosophy  of  factoring  limit  load,  which  ia  also  considered  the  maximum  to  be 
expected  (Reference  16). 

The  factors  of  safety  used  in  conventional  airframe  design  to  incorporate  conservatism  also  apply 
to  aerodynamically  heated  airframes,  but  the  conventional  factors  do  not  account  for  the  additional 
uncertainties  associated  with  elevated  temperatures.  The  additional  conservatism  must  relate  directly 
to  the  uncertainties  associated  with  the  prediction  of  structural  temperatures  and  thermal-structural 
design  analysis.  However,  the  fact  that  an  airframe  may  have  been  built  to  resist  aerodynamic  heating 
effects  does  not  necessarily  imply  an  increase  in  conventional  design  and  manufacturing  deficiencies. 
Initially,  the  use  of  relatively  unfamiliar  materials  and  forms  of  construction  in  the  heated  airframe 
and  the  need  for  computing  structural  temperatures  with  only  a limited  amount  of  flight  test  information, 
does  tend  to  increase  the  likelihood  of  deficiencies.  In  time,  however,  these  considerations  improve 
and  the  modification  of  conventional  structural  safety  factors  is  not  warranted  (Reference  23). 

As  part  of  an  overall  Air  Force  effort  to  establish  a rational  design  criterion  for  aerodynamically 
Iicated  airframes,  the  velocity  factor  has  evolved  as  a simple  and  expedient  way  of  providing  and  controlling 
thermal-structural  design  conservatism  throughout  the  design  cycle.  The  details  of  this  concept  are 
developed  in  Reference  23.  The  techniques  investigated  included  factoring  structural  loads,  temperature 
or  heat  flux,  angle  of  attack,  velocity,  and  atmospheric  density.  It  concluded  that  only  factors  on 
velocity  or  structural  temperature  (or  heat  flux)  are  likely  to  provide  an  adequate  margin  when  considering 
the  exceedances  of  performance  variables.  Of  the  two  choices,  the  factor  on  velocity  is  considered  the 
more  logical.  The  velocity  factor  provides  conservatism  in  a uniform  way  at  each  point  in  the  design 
mission  as  a function  of  Mach  Number  and  the  selected  size  of  the  velocity  factor  controls  the  Imposed 
conservatism. 

A thermal  factor  of  safety  on  loads  would  introduce  an  arbitrary  (unknown)  conservatism;  however, 
a direct,  rather  than  a presumed,  margin  of  safety  would  exist  at  the  operational  level  if  margins  were 
placed  on  performance  variables  instead.  Factoring  a performance  parameter  (speed)  provides  conservatism 
in  a way  parallel  to  that  achieved  by  factoring  loads  and  is  preferred  to  factoring  temperature  or  heat 
flux  since  performance  margins  intre  !uccd  over  operational  levels  are  more  evident  and  controllable. 

By  requiring  a design  speed  beyond  limit,  the  velocity  factor,  is  in  a sense,  a factor  on  heat 
transfer.  However,  to  specify  a direct  and  specific  factor  on  heat  transfer  would  be  a design  weakness, 
in  that  a number  of  analytical  techniques  may  exist  for  a particular  area  and  flight  regime,  with  a 
large  spread  in  the  values  tht./  provide.  From  a structural  point  of  view,  the  factor  of  safety  should 
be  associated  with  a particular  analytical  method.  For  ablation,  varied  factors  of  safety  have  been 
used  (generally  to  factor  the  thickness  of  the  ablator),  with  different  considerations  being  given  to 
each  particular  flight  application  and  for  applications  of  the  matetic'l  as  ..n  Insultatlor.  A factor 
may  also  be  used  to  represent  a combined  factor  on  heat  transfer  and  on  the  scatter  of  the  ablative 
material  characteristics.  Factors  of  safety  relating  to  thermal-structural  appllcat.iuns  can  only  have 
meaning  when  related  to  the  trajectories  or  flight  paths  for  which  they  are  needed.  A factor  of  safety 
on  a nominal  trajectory  may  be  appreciably  higher  than  those  corresponding  to  design  trajectories  based 
on  a broad  parametric  investigation  or  one  which  places  a margin  on  altitude  which  represents  a factor 
of  safety  on  temperature  (Reference  2'). 

No  single  technique  can  be  expected  to  provide  conservatism  in  a rational  way  for  all  contingencies. 

At  best,  one  type  of  factor  will  come  closest  to  providing  the  desired  conservatism  and  this  has  been 
true  of  the  velocity  factor.  Its  use  seems  reasonable  in  view  of  existing  factor  of  safety  precedents. 

A specific  design  criteria  for  aerodynamically  heated  airframes  is  being  formulated  and  tested  by 
design  application.  The  basic  criteria  is  conventional  but  it  is  modified  to  incorporate  the  velocity 
factor  concept  and  attempts  to  account  for  many  of  the  design  and  analysis  variables  which  affect 
thermal-structural  design.  The  criteria  have  not  been  finalized  and  arc  based  primarily  on  References 
16,  23,  and  24,  which  provide  insight  to  time  related  load  and  temperature  Interactions  and  the  selection 
of  critical  thermal-structural  design  polncs. 

Most  of  the  studies  and  design  concepts  reviewed  in  this  Section  have  evolved  as  an  attempt  to 
further  rationalize  structural  design  criteria.  As  previously  noted,  these  variations  to  the  current 
factor  of  safety  design  concept  tend  to  blend  with  reliability-based  concepts.  The  next  section  will 
discuss  certain  reliability-based  concepts  Investigated  by  the  Air  Force,  related  design  parameters, 
and  data  collection  programs. 
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5.  RELIABILITY-BASED  DESIGN  CONCEPTS 

The  nuaber  of  publications  treating  reliability-based  design  increased  appreciably  In  the  early 
1950' s.  Initially,  reliability  design  seemed  to  Imply,  at  least  within  the  Air  Force,  the  elimination 
of  the  factor  of  safety  as  a design  concept.  Statistically  defined  design  parameters  and  parameter 
Interactions  were  to  be  substituted  for  the  discrete  par.rmeters  and  the  factor  of  safety.  Too  often, 
however,  the  magnitude  of  the  problem  was  overlooked  and  the  acquisition  of  essential  elements  were 
overly  simplified. 

The  Air  Force  Initiated  the  development  of  a reliability  based  structural  design  criteria  for 
missiles  in  the  mid  1950' s.  Missiles  were  one  shot  devices  and  unmanned.  There  was  little  to  lose. 

Airplanes  In  turn,  were  to  become  mere  missile  launching  platforms  that  .'Ould  not  require  strength  for 
rigorous  design  maneuvers.  Combat  was  to  be  conducted  remotely.  During  this  swirl  of  revised  committment 
to  systems  development,  the  Air  Force  established  a program  to  conduct  a series  of  investigations  that 
were  to  encompass  and  define  the  total  life  cycle  of  a missile.  Considerable  priority  was  given  to 
this  effort.  The  rationalized  criteria  were  to  be  based  on  Information  obtained  through  data  gathering 
programs  and  operational  experiences.  Tl.e  broad  goal  was  to  establish  a reliability-based  structural 
design  criteria  to  replace  the  factor  of  safety  for  missiles.  This  "rationalized"  criteria  was  to  be 
placed  in  the  new  structural  strength  and  rigidity  specification  HIL-M-8856,  initially  dated  22  June 
1959.  However,  the  data  base  never  materialized,  the  1.25  factor  of  safety  Is  still  used,  and  the 
emphasis  to  develop  a reliability-based  criteria  for  missiles  has  diminished. 

When  the  need  for  a reliability-based  criteria  is  considered,  a comparison  is  usually  made  to 
existing  design  requirements  and  the  "need"  Is  often  questioned:  "Why  is  a reliability-based  criteria 
required  when  current  requirements  and  Industry  practices  have  produced  airplanes  having  a (seemingly) 
high  reliability?"  The  answer  that  evolves  must  in  some  way  relate  to  "realism"  in  design.  A reliability- 
based  design  concept,  as  stressed  by  some  in  the  literature,  is  inevitable  and  is  the  only  means  of 
providing  greater  "realism;"  the  only  way  of  "rationalizing"  the  factor  of  safety  concept. 

The  Air  Force  first  deviated  in  a significant  way  from  a deterministic  design  concept  by  defining 
probabilistic  fatigue  design  requirements.  Although  they  were  applied  "deterministically"  in  the  final 
analysis,  the  "realism"  that  operational,  environments!,  design  and  manufacturing  variations  exclude 
the  development  of  "no-fallure"  airframes  was  Implicitly  emphasized.  This  is  further  emphasized  by  the 
more  recent  changes  in  Air  Force  philosophy  by  changing  from  a "safe  life"  concept  to  a "damage  tolerant" 
concept,  as  described  In  Section  IV. 

A related  change  In  design  philosophy  should  also  be  noted.  In  1960,  In  conjunction  with  the 
Navy,  the  MIL-A-8862  (ASC)  Specification,  "Landing  and  Ground  Handling  Loads,"  was  established  and 
inuorporated  "design  load"  requirements.  These  requirements  applied  only  to  the  landing  loads  analysis. 

Limit  and  ultimate  loads  were  not  specified  for  these  conditions.  The  ince.itlve  to  deviate  from  the 
1.5  factor  of  safety  concept  was  the  "realism"  provided  by  available  operational  statistics  of  the  type 
described  In  Reference  17.  A general  dissatisfaction  with  the  "design  load"  concept,  however,  resulted 
in  a change  back  to  the  use  of  a 1.5  factor  of  safety  in  the  1971  Air  Force  revision  of  the  specification 
which  became  MIL-A-008862  (USAF).  The  design  load  concept  for  landing  loads  is  still  viewed  favorably 
and  Is  being  used  by  the  Navy,  however. 

The  Air  Force  only  applied  the  design  landing  load  concept  to  two  airplanes.  On  one  airplane  the 
concept  was  applied  to  the  fliat  .wo  models;  later  models  of  the  airplane  were  changed  and  redesigned 
using  the  1.5  factor  of  safety.  Unfortunately,  the  limited  application  of  the  design  landing  load 
..oncept  also  limits  the  experience  base  available  for  evaluation.  Apparently,  there  was  very  little, 
if  any,  penalty  involved  between  the  models  which  employed  the  two  concepts.  The  Infrequent  application 
of  the  design  load  concept  and  Its  eventual  elimination  from  MIL-A-S862  can  br  traced  to;  (1)  an  Air 
Force  requirement  that  transport  airplanes  be  compatible  with  and  certified  to  FAA  requirements;  (2)  a 
lack  of  clarity  In  the  specifications  and  differences  of  opinion  regarding  which  "loads"  are  affected 
by  the  design  load  concept  and  which  ones  are  not  (carry  through  structure,  nacelle  attachments,  external 
tank  and  store  attacluncnts,  etc.);  (3)  difficulties  in  the  Interpretation  of  interactions  with  other 
requirements  relating  to  material  yielding  and  aeroclastlc  effects;  and  (A)  the  added  difficulty  of 
applying  static  test  loads  to  the  airframe  through  the  lower  strength  landing  gear.  The  overriding 
reason  for  these  Implementation  problems,  however,  appear  to  be  poor  planning.  The  concept  was  conceived 
and  Implemented  too  quickly  and  without  appropriate  trial  applications.  No  loss  in  design  efficiency 
Is  expected  (with  rcspe.t  to  static  strength  requirements)  by  using  the  1.5  factor  of  safety,  however, 
because  current  durability,  damage  tolerance,  and  dynamic  taxic  requirements  will  add  more  weight  than 
could  be  saved  by  using  either  Che  design  load  concept  or  the  factor  of  safety  concept. 

The  Ale  Force  maintains  structural  design  specifications  and  handbooks  to  preserve  past  experiences, 
correct  previous  mistakes  and  prevent  design  oversights.  This  effort  attempts  to  maximize  structural 
Integrity  and  reliability,  but  the  concept  is  not  foolproof.  New  mistakes  arc  always  possible  with  the 
rapidly  changing  state  of  the  art  and  the  increasing  severity  of  the  operational  environment.  Because 
of  these  complexities,  the  documents  arc  difficult  to  keep  current  and  new  or  revised  design  requirements 
are  normally  written  into  the  statement-  of -work  for  any  new  system  development,  if  they  occur  between 
the  revision  Intervals  of  a specification.  Criticism,  then,  that  certain  specifications  ate  not  current 
or  that  certain  requirements  are  not  rational,  may  be  correct  but  they  do  not  hinder  new  system  developments. 
When  similar  criticisms  are  leveled  at  the  1.5  factor  of  safety,  however,  the  evaluation  Is  not  so 
simple;  should  It  be  replaced  with  a rcllability-bafsd  concept?  Uliat  Is  generally  not  appreciated  Is 
that  the  basic  airplane  design  loads  (static  strength)  are  essentially  statistical  In  nature.  The 
design  values  are  derived  from  a broad  spectrum  of  operational  experiences.  If  a distribution  wore 
assumed,  then  the  design  limit  and  design  ultimate  loads  would  represent  a certain  probability  of 
occurrence  and  exceedance  (Figure  9).  A justlfl.iblc  criticism  of  the  factor  of  safety,  though,  is  that 
a fixed  factor  does  not  recognize  the  variation  of  load  or  .trength  and  does  not  provide  a uniformly 
efficient  structure  (Ref  25).  This  effect  was  illustrated  In  References  18  and  20,  as  discussed  in 
Section  IV. 

Unofficial  Air  Force  recognition  of  a variable  factor  of  safety  concept  has  been  established  by 
allowing  certain  structural  design  deviations.  Tho  static  test  failure  of  an  engine  inlet  duct  at  1.3 
times  the  limit  pressure,  for  example,  was  accepted  when  it  was  established  that  tho  internal  dynamic 
pressure  In  the  duct  would  not  exceed  the  design  pressure  In  a dive.  The  resultant  delay,  re-design 


and  cost  to  bring  the  duct  structure  up  to  the  normal  strength  level  of  1.5  times  limit  pressure  was 
therefore  avoided  (Reference  25) . 

The  Air  Force  has  not  formally  adopted  a reliability-based  structural  design  criteria,  although 
some  requirements  have  an  associated  probability  of  occurrence.  Available  procedures  that  could  be 
adopted  vary  in  concept  and  detail,  but  their  philosophical  principles  are  the  same.  References  26  and 
27  summarize  some  of  the  philosophical  aspects  that  appear  in  the  open  literature  and  also  note  the 
complexity  of  the  reliabi) ity-based  design  problem,  as  paraphrased  in  the  following  two  paragraphs. 

The  many  proposals  for  a more  rational  criteria  are  related  to  the  appearance  of  new  structural 
materials  which  exhibit  Improved  strength  and  stiffness  or  weight  characteristics.  Other  considerations 
are  the  extreme  increases  in  the  structural  loading  environment  and  concern  with  economic  costs. 

Designing  to  an  acceptable  risk  while  keeping  all  design  factors  in  proper  economic  perspective  would 
seem  to  be  effective  but  the  concept  of  risk  must  be  quantified  before  an  accepLuble  lIs'iC  level  can  be 
determined.  The  new  materials  also  tend  to  exhibit  variations  which  could,  in  a deterministic  design, 
require  such  large  factors  of  safety  as  to  nullify  the  Improvements.  The  increase  in  extremes  of  the 
structural  load  environment  are  primarily  new  to  the  civil  engineering  field  while  economic  costs  are 
perhaps  new  to  the  aeronautical  field.  [Reference  28  notes  that  the  aeronautical  engineer  has  for 
many  years  considered  new  failure  criteria  (fatigue  and  creep),  new  materials  and  construction  (brittle 
materials;  flberous  weaves)  and  more  complex  loading  conditions  (temperature-load  histories);  this  has 
resulted  in  greater  variability  in  the  applied  and  falling  loads  than  has  been  encountered  in  the 
past.)  Picking  the  worst  possible  load  conditions  for  design  is  no  longer  considered  economically 
feasible  under  a broad  spectrum  of  load  conditions  and  the  statistics  of  extremes  must  be  considered 
for  r.'.tlonal  design.  Reliability-based  analysis  permits  a more  consistent  approach  to  structural 
safety  by  Including  the  statistical  variability  of  load  and  strength  in  the  factor  of  safety  evaluation 
(Reference  26). 

Most  of  the  early  studies  in  probabilistic  design  considered  only  the  fundamental  problem  in  which 
all  of  the  strength  variables  and  the  load  variables  were  lumped  into  two  random  variables.  These 
studies  concentrated  on  the  effects  of  different  safety  factors,  coefficients  of  variation  and  frequency 
distributions.  Later  studies  included  multi-member  and  multi-load  structures,  different  levels  of 
failure  and  the  application  of  decision  theory.  Several  problems  must  be  considered  in  the  context  of 
a reliability-based  design.  First  is  the  reliability  analysis  of  structures  with  derived  or  assumed 
probability  distributions  for  random  variables,  including  load  and  strength  distributions;  developing 
and  constructing  the  necessary  computational  models  which  account  for  indeterminancy,  the  types  of 
failure  modes  (Including  elastic,  brittle  and  collapse  modes),  the  number  of  load  conditions  and  failure 
modes,  and  their  statistical  correlation.  Another  problem  is  the  design  of  a structure  in  the  context 
of  a random  variable  of  safety  for  a given  probability  of  failure;  the  random  variable  could  be  cost  or 
weight.  An  additional  problem  is  that  of  parameter  sensitivity  and  determining  their  affects  in  the 
load  and  strength  descriptions.  Most  reliability  analyses  assume  that  strength  and  load  distributions 
are  known;  the  high  cost  of  obtaining  load  and  strength  data  will  probably  necessitate  the  acceptance 
of  lower  confidence  levels  in  structural  design  than  professional  statisticians  usually  recommend. 
Subjective  statistical  analysis  is  needed  together  with  studies  to  determine  the  effect  on  optimum 
weight  and  cost  due  to  changes  in  choice  of  frequency  distribution,  coefficients  of  variation  and  other 
parameters  (Reference  27). 

As  part  of  its  program  to  maintain  and  develop  structural  design  criteria,  the  Air  Force  has 
sponsored  various  Investigations  intended  to  lead  to  a reliability-based  criteria  for  both  airplanes 
and  missiles.  One  investigation  (Reference  21)  was  partially  presented  in  Section  IV.  This  investigation 
will  be  further  discussed  with  two  others  (Reference  29  and  30).  These  three  Investigations  emphasized 
static  strength  reliability,  although  fatigue  or  durability  requirements  can  be  incorporated  within 
these  concepts.  Other  Air  Force  investigations  have  more  thoroughly  emphasized  the  fatigue  aspects  of 
a reliability-based  criteria.  Reference  31,  for  example,  treats  fatigue  design  considerations  while 
Reference  32  emphasizes  fatigue  but  also  provides  limited  treatment  of  static  design  considerations. 
Reference  31  is  an  extension  of  Reference  32  and  Reference  33  is  an  evaluation  of  the  concepts  In 
Reference  31.  These  fatigue  related  references  arc  noted  here  only  for  completeness  and  will  not  be 
emphasized  further.  The  three  Investigations  relating  primarily  to  static  strength  design  considerations, 
however,  will  be  summarized  in  more  detail  because  of  their  direct  correlation  with  the  factor  of 
safety  concept.  In  expanding  those  three  reliability-based  efforts,  the  philosophy  of  the  techniques 
will  be  emphasized  and  not  the  technical  aspects  of  their  development  or  application. 

A statistically  based  concept  developed  for  missile  design  is  found  in  Reference  21,  Part  II.  The 

concept  is  broad,  however,  and  can  be  applied  to  almost  any  reliability-based  design  problem.  The 

design  concept  is  basically  a "framework"  developed  to  be  consistent  with  the  premise  that  there  is  no 
definite  demarcation  between  safe  and  unsafe  design,  but  a gradual  change  in  reliability  between  safe 
and  unsafe.  The  idea  that  a sharp  change  exists  between  safe  and  unsafe  can  cause  unnecessary  redesign 

for  every  slight  change  in  design  load  or  reduction  in  allowables.  Redesign  should  be  required  only 

when  the  over-all  reliability  of  the  system  decreases  appreciably.  The  terra  "framework"  applies  because 
the  wide  scope  and  complexity  of  the  problem  did  not  allow  final  refinements  to  be  nude.  This  concept, 
as  discussed  In  Reference  21,  is  described  in  the  following  paragraphs. 

This  concept  uses  any  number  of  design  variables  that  arc  essentially  Independent  of  each  other  to 
detemlno  Interaction  envelopes  that  separate  failure  from  non-failure  regions.  Design  parameters  are 
presented  so  that  "crlticalness"  continuously  increases  as  parameter  values  increase  or  decrease.  By 
superposition,  a single  Interaction  envelope  is  formed  and  the  probability  of  not  generating  points  in 
the  failure  region  is  the  quantitative  reliability  of  the  system  for  the  time  period  considered.  To 
simplify  the  computation  of  reliability  (which  could  be  obtained  by  integrating  the  content),  an  equivalent 
value  of  each  parameter  is  defined  such  that  the  envelope  content  is  approximated  by  simple  multiplication 
of  the  probabilities  associated  with  the  probability  value  of  each  parameter.  Any  number  if  statistical 
parameters  can  be  used.  Limits  are  Imposed  only  by  the  analysis  time  and  data  available.  As  data  is 
defined,  the  number  of  parameters  can  be  optimized  and  should  Include  five  to  eight  that  are  random 
varying  and  fifteen  to  thirty  that  are  systematically  varying;  any  distribution  can  be  accomodated 
without  the  necessity  of  having  to  find  a special  function  of  the  variable. 

The  intersections  of  any  two  Interaction  curves  are  defined  as  "nodal  points,"  which  are  used  as 
design  points  (Figure  10).  The  analysis  is  relatively  insensitive  to  the  exact  interaction  envelope 


shape  because  any  reasonable  envelope  shape  having  the  same  content  will  pass  near  Che  same  design 
points.  The  design  conditions  or  nodal  points  are  defined  by  two  parameters,  one  having  a "limiting 
value"  (Xj^  y ) and  the  other  a "reference  value"  (Xj^  y ).  The  probability  value  (Xp  y ) at  each  point 
is  equal  to  the  limiting  value  minus  a correction  factor  (X  p ) which  Is  approximated  by  analyzing 
representative  probability  distribution  shapes  of  signif Icant^^parameCers  (Figure  11).  The  pictorial 
representation  is  limited  but  a mathematical  extension  is  completely  valid  and  feasible  for  any  number 
of  parameters. 

Power  spectral  techniques  are  used  to  evaluate  time  dependent  effects,  and  other  simplified  techniques 
were  developed  for  handling  systematic  variations.  A method  for  determining  the  required  confidence 
levels  of  parameters  is  also  given  to  assure  consistent  reliability  analysis,  and  accommodations  are 
made  for  fatigue  and  creep  effects.  Greater  approximations  are  allowed  for  secondary  design  effects 
Liian  for  primary  effects. 

The  basic  concept,  then  is  a semi-empirical  method  for  quantitatively  determining  the  reliability 
of  a defined  structure,  or  for  the  design  of  a structure  to  a prescribed  reliability.  The  development 
is  based  on  and  justifies  two  basic  premises:  (1)  that  by  the  judicious  selection  of  design  (nodal) 
points  the  true  interaction  envelope  shape  is  unimportant  and  (2)  that  the  reliability  of  a system  can 
be  calculated  with  sufficient  accuracy  by  simple  multiplication  of  the  probabllltes  of  equivalent 
parameter  probability  values  rather  than  by  integration  of  the  interaction  envelope  content.  Although 
seemingly  complex  when  reviewed,  the  method  of  Reference  21,  Part  II,  can  by  using  a minimum  of  parameters 
and  certain  refinements,  and  with  some  additional  development  and  appropriate  data,  approach  the  factor 
of  safety  method  in  simplicity. 

A different  reliability-based  concept  is  found  in  Reference  29.  Reference  21  developed  a statistically 
based  quantitative  structural  design  criteria  that  relates  the  probabilistic  nature  of  design,  opera- 
tional and  environmental  experiences  to  structural  performance.  Reference  29  developes  a deterministic 
structural  design  criteria  that  uses  a quantitative  objective  and  statistical  techniques,  as  described 
in  the  following  paragraphs. 

This  design  method  is  characterized  by  the  thought  that  the  ability  to  calculate  a probability  of 
failure  when  load  and  strength  spectra  are  assumed  to  be  known,  are  quite  different  than  the  ability  to 
determine  the  true  structural  reliability  of  an  operational  structural  system.  The  method  also  incorporates 
certain  considerations  that  appear  to  be  overlooked  in  other  approaches.  These  "oversights"  are:  (1) 
errors  or  discrepancies  which  occur  between  actual  and  calculated  spectra;  (2)  the  influencial  effect 
of  testing  as  a means  of  design  error  disclosure;  (3)  the  necessity  for  demonstrating  proof  of  compliance 
with  requirements;  and  (4)  the  necessity  for  assigning  responsibility  for  actions  which  affect  structural 
reliability.  Other  interactions  with  non-structural,  operational,  managerial  and  contractural  areas 
are  also  included.  The  overall  investigation  and  proposed  design  concept  evolved  in  three  steps. 

The  first  step  evaluated  the  various  functions  v'hich  contribute  to  structural  design.  The  second 
step  evaluated  and  compared  the  current  factor  of  safety  concept  and  a (hypothetical)  purely  statistical 
structural  reliability  concept  to  the  structural  performance  and  design  functions  established  in  the 
first  step.  The  third  step  evaluated  existing  and  proposed  reliability-based  concepts  to  the  same 
standards  of  evaluation  used  in  step  two.  These  evaluations  concluded  that:  (1)  the  current  factor  of 
safety  design  technique  is  a satisfactory  system  but  that  more  stringent  future  requirements  will 
minimize  the  effectiveness  of  the  system;  (2)  a purely  statistical  structural  reliability-based  system 
is  not  practical  since  there  is  no  way  to  accurately  measure  structural  reliability  and  it  is  not 
possible  to  write  definitive  requirements  to  demonstrate  the  reliability  (proof  of  compliance);  and  (3) 
that  none  of  the  known  structural  reliability-based  concepts  in  the  literature  today  provides  a satis- 
factory foundation  for  a quantitative  structural  design  criteria  based  on  statistical  methods.  To 
elaborate  slightly  and  provide  an  appreciation  for  the  design  concept  which  evolved,  the  philosophies 
which  governed  the  develo ament  will  be  expanded  in  the  following  paragraphs. 

The  fundamental  purpose  of  any  structural  design  effort  is  to  develops  an  operational  structural 
system  that  satisfactorily  performs  its  mission.  This  development  is  the  result  of  many  management  and 
engineering  decisions  which  are  a key  element  in  the  success  or  failure  of  the  design  effort.  One 
aspect  of  the  factor  of  safety  concept  is  that  the  design  effort  can  be  practical  and  easily  administered 
because  > . has  an  inherent  proof  of  compliance  (test)  provision.  Its  fundamental  oroblem  is  that  it 
has  no  clearly  identifiable  quantitative  design  objective  to  satisfy.  The  available  logic  cannot 
resolve  the  comparative  adequacy  of  different  factor  of  safety  values.  In  some  design  areas,  such  as, 
fatigue  or  high  temperatures,  the  f.actor  of  safety  is  not  even  directly  applicable  to  the  definition  of 
the  design  requirements.  The  concept  only  defines  a relationship  between  limit  and  ultimate  load, 
which  normally  controls  the  design  strength  level  and  does  not  allow  for  an  assessment  of  its  "correctness," 
ocher  than  "failure."  Positive  margins  of  safety  do  not  prevent  failure;  gross  errors  in  design  loads, 
analysis  and  large  strength  scatters  contribute  Co  failure  at  limit  load  or  less.  Structural  tests,  on 
the  other  hand,  are  a nearly  perfect  disclosure  of  gross  errors  if  the  strength  scatter  is  small,  as  is 
customary.  The  trend  toward  greater  scatter  and  a lessening  or  inability  to  disclose  analytical  errors, 
requires  that  the  possibility  of  failures  below  limit  be  considered  more  seriously  in  the  future. 

Further,  test  conditions  are  normally  selected  on  the  basis  of  the  strength  analysis,  and  the  actual 
design  conditions  are  becoming  more  difficult  to  simulate  when  testing;  successful  ground  tests, 
therefore,  do  not  guarantee  successful  operational  performance,  and  flight  testing  will  remain  an 
important  design  development  consideration  regardless  of  the  design  concept  used. 

Current  requirements  have  evolved  primarily  os  a reaction  to  past  problems  and  the  assumption  that 
future  structural  systems  will  liave  the  same  characteristics  as  past  systems  is  not  necessarily  valid. 

When  structural  failures  do  occur,  the  deterministic  nature  of  the  factor  uf  safety  concept  allows  the 
determination  of  the  cause,  the  responsibility,  and  the  corrective  action  to  be  taken.  Unfortunately, 
because  of  the  many  interactions  between  the  structure  and  other  design  areas  which  contribute  to 
structural  integrity,  responsibility  is  not  always  recognized  until  ofter  a failure  has  occurred. 

and  other  considerations  previously  noted  relate  primarily  to  the  factor  of  safety  concept,  but 
they  also  interact  with  reliability-based  concepts.  Especially  important  are  the  considerations  that 
establish  design  compliance  and  responsibility  when  failure  occurrs,  VRicn  cause  and  responsibility  are 
not  determinable,  neither  is  the  corrective  action. 

The  structural  design  concept  that  evolved  In  Reference  29  utilized  the  desir.able  features  of  the 
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factor  of  safety  concept  and  Improved  or  replaced  those  not  desirable.  The  following  basic  characteristics 
are  Included  In  the  concept: 

1.  The  deterministic  type  of  requirements  that  give  t^e  factor  of  safety  concept  Its  pratlcallty 
and  admlnlstrablllty  are  retained. 

2.  A clearly  Identifiable  objective  that  serves  as  a basis  for  judging  any  proposed  modification 
to  the  factor  of  safety  concept  Is  established. 

3.  A structural  reliability  goal  is  part  of  the  objective.  The  goal  Is  not  a requirement  since 
structural  reliability,  per  se,  cannot  be  determined  accurately  enough  to  serve  as  a contractual 
requirement. 

4.  The  techniques  to  convert  the  structural  reliability  goal  Into  deterministic  requirements 
based  on  statistical  considerations  are  developed. 

5.  The  capability  to  deal  with  structural  systems  having  large  strength  scatters  is  incorporated. 

6.  Specific  problems  such  as  fatigue  and  high  temperature  design  can  be  Integrated  into  the 

structural  design  to  attain  the  defined  objective. 

7.  The  crucial  Interfaces  with  non-structural  design  requirements  are  Identified.  Provisions 

are  made  for  assigning  responsibility  for  every  function  that  affects  structural  integrity. 

8.  The  concept  of  testing  as  a disclosure  of  error  In  formulating  design  requirements  is  utilized. 

Basically,  the  structure  should  have  a capability  to  survive  designated  overload  and  understrength 
situations  caused  by  undetected  errors  or  oversights.  The  factor  of  safety  concept  provides  this 
capability  but  the  provision  Is  Indirectly  and  inconsistently  applied.  Structures  with  large  strength 
scatters  are  basically  more  prone  to  fall  from  understrength  considerations  rather  than  from  overloading. 
The  concept  in  Reference  29  establishes  separate  and  distinct  requirements  for  understrength  and  overload 
situations.  The  requirements  are  based  on  probabilities  and  statistics  and  are  selected  to  be  consistent 
with  a level  of  structural  reliability  appropriate  to  the  airplanes  mission.  The  design  and  mission 
relationships  are  Illustrated  In  Figure  12.  Tne  central  bar  indicates  that  the  limit  design  load 
Includes  a provision  to  handle  an  understren^th  structure  to  avoid  failure  at  limit  load.  The  right  or 
left  bar  Indicates  the  overload  provision.  The  left  bar  illustrates  a large  overload  provision  and 
overrides  the  understrength  provision.  ThiS  could  represent  a relatively  low  reliability,  high  load 
factor  fighter  airplane.  The  right  bar  illustrates  a design  situation  with  a smaller  overload  requirement. 
The  understrength  provision  is  now  more  critical  and  governs  the  design.  This  could  represent  a design 
requirement  for  a highly  reliable,  low  load  factor  transport  airplane.  Once  the  appropriate  design 
values  are  chosen,  they  become  deterniAnlstlc  and  are  as  easy  to  administer  as  the  conventional  factor 
of  safety  concept. 

The  first  Implementing  step  Is  to  select  a structural  reliability  goal  consistent  with  the  mission. 

The  goal  is  not  a requirement  and  suggested  values  are  given  In  References  29  and  30.  The  limit  and 
ultimate  design  conditions  are  two  separate  conditions  based  on  the  reliability  goal  and  established  by 
statistical  or  qualitative  co.isideratlons,  which  reflect  available  experience.  The  design  limit 
condition  is  the  upper  bound  of  a normal  or  expected  (permissible)  operating  condition  while  the  ultimate 
condition  is  an  abnormal  operational  condition  reached  only  as  the  result  of  an  operational  error  or 
failure  of  a non-structuroi  system.  Failures  within  the  understrength  design  provision  are  a structural 
responsibility  and  require  correction,  while  failures  from  overloads  require  operational  corrections. 

There  Is  no  fixed  facto'  of  safety  separating  the  limit  and  ultimate  condition;  the  ultimate  condition 
in  Reference  29  does  njt  represent  the  conventional  meaning  of  ultimate  load.  The  condition  Is  separate 
and  unrelated  to  the  limit  condition,  whose  meaning  does  not  change.  The  "ultimate"  condition  is  a 
"design"  condition  based  on  a rare  or  abnormal  situation  and  may  be  significantly  different  from  the 
conventional  ultimate  load. 

The  basic  structural  design  is  qualified  and  approved  by  conventional  ground  and  flight  tests. 

Ground  test  lords  arc  defined  by  a limit  or  an  ultimate  test  factor  of  safety.  The  factor  selected 
varies  according  to  the  established  structural  reliability  goal  and  by  the  number  of  tests  conducted. 
Example  valves  are  shown  In  Figures  13  and  lA.  Flight  tests  are  conducted  In  a conventional  manner  and 
operational  flight  load  monitoring  arc  required  to  verify  operational  consistency  with  design.  If  not 
conslstcn.,  the  struct'^rc  would  require  modification  when  operations  are  detrimental  or  the  operational 
procedures  may  require  some  change. 

tnere  arc  many  ramifications,  qualifications,  advantages  and  disadvantages  related  to  rcllablllty- 
bascj  design  concepts  as  expressed  In  Reference  29.  Most  of  the  associated  disadvantages  or  problems 
are  not  new  but  have  always  been  problems,  such  as  the  statistical  defi.iltlon  of  design  data.  Ko  new 
problems  are  created  by  Introducing  reliability-based  concepts  but  old  problems  became  more  clearly 
defined.  T.ie  basic  advantage  of  the  proposed  concept  in  Reference  29  Is  Its  ability  to  establish 
structural  performance  In  terms  of  a quantitatively  definable  goal.  This  permits  the  definition  of  the 
minimum  structural  requirements  to  meet  the  goal.  It  also  permits  the  justification  of  a less  severe 
structural  design  crltcila  when  warranted.  Because  each  of  the  design  aspects  Is  quantltlzed,  trade- 
offs can  be  made  between  criteria  reductions  and  the  difficulty  (technical,  cost,  time)  of  providing 
more  efficient  structural  characteristics. 

The  proposed  reliability-based  concept  in  Reference  29  Is  reviewed  In  Reference  30  to  identify 
data  requirements,  necessary  changes  to  design  spacifications  and  handbooks.  Interactions  with  non- 
structural  design  areas  and  the  steps  required  to  implement  the  concept.  To  Illustrate  each  step  of 
the  concept.  Reference  30  uses  a simple  design  example.  First,  simplified  dummy  data  Is  employed  and 
then  realistic  data.  The  categories  of  required  data  are  defined  further  by  a study  of  data  pertinent 
to  the  C-141  cargo  airplane  and  then  by  a trial  application  o.'  the  concept  to  its  wing.  The  revision 
cf  data  to  reflect  an  improved  state-of-knowledgc  at  each  design  stage  and  during  the  life  of  the 
vehicle,  and  the  form  In  which  the  required  data  might  be  standardized.  Is  also  discussed.  Although 


the  limited  study  did  not  allow  an  extensive  treatment  of  data  requirements.  Reference  30  provides 
insight  to  the  complexities  of  the  data  problem  as  it  relates  to  reliability-based  design  and  similar 
concepts.  The  data  requirements,  limitations  and  design  interactions  are  presented  in  the  following 
paragraphs. 

To  be  effective,  data  must  be  established  and  updated  continuously.  Fundamental  data  are  operational 
load  spectra,  error  functions  and  strength  distributions.  These  data  will  change  periodically  during 
the  total  lifetime  of  a specific  airplane.  The  particular  periods  that  permit  progressive  updating  are 

the  initial,  detail  and  final  design  phase,  before  and  after  tests,  and  before  and  during  airplane 

operations.  It  is  the  operational  environment  that  provides  the  best  opportunity  to  obtain  quantities 
of  new  data,  which  are  also  pertinent  to  other  design  concepts. 

In  June  1954,  a special  panel  report  (Reference  34)  of  the  NACA  Subcommittee  on  Aircraft  Loads 
recommended  a program  to  obtain  statistical  information  on  maneuvers  and  related  inflight  loads,  whether 
caused  by  pilot  Inducement  or  atmospheric  turbulence.  The  panel  also  recommended  that  the  Air  Force 
and  Navy  obtain  time  histories  of  three  linear  and  three  angular  accelerations  about  mutually  perpendicular 
axis,  airspeed  and  altitude  to  establlcl.  a statistical  design  base.  The  recommended  statistical  maneuver 
load  program  was  initiated  as  a Jolr^  effort  by  the  Air  Force,  Navy  and  Che  NASA  in  1956. 

In  1958  the  Air  Force  outlined  a long  term  program  Co  collect  and  utilize  flight  measured  data. 

The  program,  initiated  in  1959,  was  to  develops  techniques  for  integrating  Che  statistical  data  into 

existing  design  criteria,  review  and  Improve  Che  data  recording  and  reduction,  and  to  establish  fundamental 
requirements  for  structural  criteria  based  on  statistical  methods.  The  resulting  effort  identified 
certain  problems  which  were  grouped  into  three  categories:  the  definition  of  design  conditions,  the 
definition  of  component  strength  distributions,  and  mathematical  procedures  relating  the  first  two  to 
structural  reliability.  The  program  also  led  to  the  sizing  and  establishment  of  a data  reduction 
facility  by  the  Navy  and  an  8-channel  recorder  development  program  by  the  Air  Force.  State-of-the-art 
limitations  eventually  terminated  the  recorder  development  program  and  in  turn  closed  the  data  reduction 
facility  in  1969.  References  35  and  36  are  documents  relating  to  this  effort.  Other  investigations 
which  have  defined  data  requirements  and  collection  programs  for  missiles  are  described  in  References 
16,  24,  37,  38,  39,  40  and  41. 

More  recently,  the  operational  data  recording  program  for  airplanes  has  continued  as  the  Air 
Force's  Aircraft  Structural  Integrity  Program  (ASIP),  as  defined  in  Military  Standard  1530A,  by  the 
same  title,  dated  11  December  1975.  As  part  of  the  ASIP,  each  airplane  system  will  be  monitored  to 
obtain  time  history  records.  The  parameters  necessary  to  monitor  operational  usage  and  derive  stress 
spectra  for  critical  structural  areas  will  be  measured  in  approximately  20  percent  of  the  operational 
force. 

To  accomplish  the  ASIP,  the  Air  Force  initiated  plans  in  1968  to  develop  a new  and  more  universal 
multi-channel  recording  system,  to  less  stringent  standards  than  the  previous  8-channel  recorder.  New 
requirements  were  prepared  and  in  June  1970  the  development  of  a 24-channel  digital  recording  system 
and  a ground  playback  unit  were  started.  The  system  has  been  developed  and  is  now  in  limited  use.  The 
data  tapes  for  each  system  will  be  collected  and  compiled  at  a single  location  when  the  program  is 
fully  implemented.  The  parameters  measured  and  sample  rates  can  be  varied  to  the  specific  needs  of 
each  system.  Plans  to  establish  the  necessary  parameter  correlations  and  design  load  spectra  from  the 
ASIP  data  are  being  formulated. 

The  major  objective  and  Justification  for  the  multi-channel  program  is  to  provide  a better  tool  to 
accomplish  fatigue  tracking.  However,  because  of  the  high  commonalty  between  duta  needed  for  fatigue 
and  statistically  based  strength  design,  the  reliability-based  design  concepts  will  also  benefit.  VIhen 
a recorder  program  on  a certain  system  "matures"  to  the  point  that  statistical  stability  is  obtained 
and  no  new  operational  fatigue  related  information  is  produced,  or  when  certain  parameters  attain 
statistical  stability  and  need  not  be  recorded  full  time,  the  resulting  surplus  of  recorder  capacity 
can  be  used  to  establish  statistical  strength  criteria  or  to  fill  knowledge  gaps;  for  example,  the 
phasing  of  Power  Spectral  Density  (PSD)  loads.  In  gust  analysis,  current  PSD  methods  allow  a fairly 
precise,  but  separate,  determination  of  shear,  bending  and  torsion  at  a given  location;  the  phasing  of 
the  three  vectors  is  largely  a guess.  The  addition  of  strain  gage  clusters  or  rusettes  at  selected 
locations  could  provide  actual  examples  of  the  amplitude  and  frequency  relationships.  Such  data  will 
be  essential  in  future  designs  to  express  applied  loads  and  structural  strength  in  a common  set  of 
terms. 

Ideally,  deri  'cd  data  can  be  standardized  and  categorized.  A convenient  approach  would  be  provided 
by  charts  relating  the  required  design  and  test  factors  to  the  reliability  levels  in  terms  of  parameters 
describing  the  load  strength  distributions,  the  error  function  and  the  number  and  type  of  tests. 
Theoretically,  it  would  appear  possible  to  develop  a single  load  spectrum  for  each  location,  which 
would  contain  the  total  load  occurrences  for  an  airplane  lifetime.  However,  the  simultaneous  consideration 
of  both  limit  (normal)  and  ultlmatt  (abnormal)  loading  conditions  will  seldom  be  possible  because  the 
permissible  strength  level  will  generally  be  different.  Each  structural  location  will  require  separate 
analysis,  since  both  load  and  strength  distribution  will  differ  from  point  to  point. 

The  statistics  available,  even  on  airplanes  which  have  extensive  operational  experience,  are  not 
adequate.  For  example,  additional  information  is  requited  on  the  probabllltcs  of:  (1)  weight  and 
weight  distribution;  (2)  speed  and  altitude;  (3)  types  of  load  conditions  (gust,  pull-up,  rudder  kick, 
etc.);  (4)  level  of  loading  (l.t  terms  of  a basic  parameter);  (5)  time  history  of  loading  (to  describe 
local  loading);  (6)  associated  load  systems  (pressure,  thermal  gradient,  etc.).  These  probabilities 
are  not  Independent  and  the  resultant  probability  of  each  combination  is  also  needed.  In  addition  to 
the  average  or  typical  conditions  defining  each  segment  of  the  mission  profile,  it  is  necessary  to 
derive  or  assume  the  shape  and  distribution  about  the  mean.  Without  this  detailed  level  of  data,  no 
realistic  estimate  of  the  risk  of  failure  can  be  made. 

Although  extensive  material  strength  data  exist,  the  allowables  represent  only  one  discrete  point 
in  the  distribution.  The  form  of  data  required  consists  of  the  mean  and  standard  deviation  and  the 
shape  of  the  distribution  to  be  used.  The  structural  strength  of  the  final  component  will  also  reflect 
the  variations  Imposed  by  all  of  the  inherent  operations  in  fabrication  and  assembly.  Data  on  the 
strength  of  various  structural  configurations  exists  only  in  a random  manner  and  usually  in  insufficient 
quantity  to  provide  adequate  statistical  distributions. 


It  is  frequently  necessary  to  assume  that  all  observations  are  of  a single  homogeneous  population 
whose  ulstrlbuLlon  follows  a standard  form.  Such  assumptions  often  give  good  fits  near  the  most  frequently 
occurring  values  but  for  the  structural  reliability  problem  other  factors  require  emphasis.  The  major 
difference  between  structural  and  common  reliability  analysis  Is  that  the  "mean  time  to  failure"  Is  not 
a desirable  measure  of  reliability.  It  Is  the  risk  of  failure  that  Is  required  for  a structure.  There 
Is  no  "acceptable"  failure  rate  and  much  more  emphasis  Is  therefore  placed  on  high  (abnormal)  loads  and 
unusually  low  strengths.  This  emphasis,  then,  requires  that  the  statistical  representations  match  the 
appropriate  tails  of  the  distributions  rather  than  the  region  near  the  more  frequently  occurring  values. 

The  formal  recognition  of  possible  errors  Is  probably  more  Important  than  the  specific  definition 
of  an  error  function.  The  error  function  may  describe  any  number  of  discrepancies,  however  caused.  In 
terms  of  the  distribution  of  the  probable  mean  strength  of  the  structure.  A number  of  suitable  functions 
are  available  for  Initial  design  use.  The  degree  of  dispersion  (coefficient  of  variation)  has  relatively 
little  Influence  once  the  test  results  have  been  Incorporated,  when  tests  are  used  as  an  error  disclosure. 

A relatively  low  risk  would  probably  be  Introduced  by  the  adoption  of  a standard  error  function. 

The  Implementation  of  any  reliability-based  technique  will  present  certain  problems  and  Reference 
30  suggests  a two  stage  process.  Initially,  there  will  be  Insufficient  data  available  to  Implement  s 
total  reliability-based  design  concept  and  emphasis  should  be  placed  on  the  comparative  similarities 
with  the  existing  factor  of  safety  design  concept  rather  than  the  differences.  However,  even  restricting 
the  reliability  concept  to  design  conditions  for  which  data  Is  available  will  help  establish  a correct 
undeistandlng  of  the  probabilistic  processes  and  encourage  the  acquisition  of  the  data  required  for 
further  implementation. 

The  first  phase  would  apply  the  reliability  concept  to  selected  design  conditions  and  primarily 
emphasize  familiarity  with  terminology  and  mathematical  relationships;  the  relative  Importance  of 
parameters;  evaluating  the  implied  rellabllltl..s  of  existing  airplanes;  and  Insuring  that  continuity 
with  existing  design  concepts  exists  so  that  no  abrupt  changes  In  structural  Integrity  will  exist.  The 
interactions  between  "static"  strength,  "fall-safe"  strength,  "fatigue"  strength  and  "damage  tolerance" 
strength  also  require  Identification  to  permit  the  whole  spectrum  of  structural  reliability  to  be 
expressed  in  a consistent  manner. 

The  second  or  final  stage,  that  of  achieving  a meaningful,  completely  probabilistic  concept  will 
not  be  possible  until  quantities  of  additional  statistical  data  are  obtained,  especially  for  asymmetric 
flight  cases  and  combinations  of  parameters  which  are  not  Independent.  Not  only  must  every  possible 
cause  of  loading  be  established  in  probabilistic  terms,  but  every  factor  affecting  the  strength  must  be 
established.  Unless  a total  picture  Is  assembled,  nothing  wil'  be  known  about  the  relative  Importance 
of  the  various  design  conditions  and  Interactions,  or  about  ways  of  changing  the  reliability  results  by 
modifying  the  operating  conditions  or  by  redesign  of  the  structure.  When  reliability  results  are 
further  specified  as  a single  numerical  value,  even  when  specified  as  a goal,  the  relative  merit  of 
different  values  regarding  .safety  and  possible  redesign  must  be  considered.  The  concept  of  a single 
numc''lcal  value  for  the  reliability  of  an  airframe  or  even  a specific  location  on  the  airframe  is 
supetf iclally  attractive,  but  any  rsal  advantage  is  completely  offset  by  problems  of  Interpretation  of 
tr.e  number.  Any  judgement  as  to  acceptability  of  one  reliability  number  over  another  that  is  slightly 
different  will  remain  arbitrary.  It  is  probable  that  a relative  risk  assessment  technique  will  prove 
lo  be  worth  while  even  when  all  of  the  necessary  statistical  data  are  available  and  a completely  proba- 
bilistic design  concept  can  be  achieved.  Final  Implementation  will  be  governed  by  experiences  gained 
during  the  first  phase  and  the  availability  of  design  data. 

The  next  section  will  attempt  to  place  these  thoughts  and  Ideas,  and  those  of  previous  sections, 

Into  perspective  by  further  relating  them  to  current  design  practice. 


6.  CONCEPT  INTERACTIONS 

The  factor  of  safety  has  lost  some  of  Its  appeal  in  recent  years  and  probability  analysis  has  been 
emphasized  as  a more  "rational"  concept.  Formerly,  the  complexity  of  reliability-based  concepts  cen- 
tered around  the  analytical  aspects  of  the  solutions  but  this  difficulty  hos  been  off-set  by  current 
computer  technology.  Today  the  prime  restraint  Is  available  design  data  in  the  proper  statistical  form 
(Reference  21). 

Dissatisfaction  with  the  factor  of  safety  concept  became  more  apparent  during  the  early  1960's 
when  surveys  of  airplane  and  missile  manufacturers  were  conducted  <n  conjunction  with  various  Air  Force 
structural  design  criteria  development  programs.  The  general  industry  feeling  that  the  factor  of 
safety  is  growing  more  and  more  inadequate  has  apparently  not  changed.  The  initial  dissatisfaction 
applied  primarily  to  missiles,  but  airplanes  were  not  excluded.  The  surveys  also  found  that  the  degree 
of  availability  of  flight  me.isured  data  varies  greatly  between  systems.  Its  quality  and  quantity  are 
both  deficient  and  the  parameters  most  needed  for  reliability-based  design  concepts  are  often  not 
measured.  Cost  and  the  inability  to  access  a system  for  vhe  purposes  of  instrumentation  and  data 
measurement  often  become  insurmountable  problems. 

Whether  using  a factor  of  safety  or  a reliability  based  concept,  the  airframe's  probability  of 
failure  will  be  sensitive  to  the  number  of  significant  design  parameters  (a.'tsumlng  all  significant 
parameter.^  are  accounted  for)  and  their  statistical  distribution.  The  design  data  must  encompass  all 
of  the  natural  environments.  Induced  environments,  operational  variations,  mat<;'‘ial8  properties,  and 
bullc-up  structural  properties;  the  total  number  of  specific  parameters  rcqulri.i,;  statistical  definition 
becomes  significantly  large.  The  .state-of-the-art  and  practical  limitations  in  establishing  accurate 
statistical  data  for  each  significant  parameter  ts  such  that  the  actual  results  may  be  more  academic 
tlun  related  to  actual  needs.  Unless  the  available  data  are  carefully  selected  and  reduced,  considerable 
effort  could  be  expended  with  few  commensurate  results. 

Although  the  validity  of  extrapolating  data  for  design  use  Is  taken  for  granted,  certain  precautions 
must  be  exercised.  Too  often  design  data  have  been  compiled  from  Inappropriate  or  limited  samples. 

Data  must  reflect  operational  conditions  from  ail  segments  of  the  Air  Force;  pilots  must  be  "qualified” 
or  "typical,"  not  highly  experienced  flight  test  pilots;  weather  conditions  must  be  proportioned  between 


good  and  bad  flying  conditions,  and  daylight  and  night  operations;  and  weather  cycles  occurring  during 
the  year  and  over  a period  of  years  must  be  considered.  Some  parameters  have  physical  limits  or  "practical 
upper  limits  and  any  assumed  ditribution  must  consider  a reasonable  cut-off  value.  Extreme  values 
become  less  accurate  as  they  progress  away  from  the  mean  and  Influence  design  confidence.  Values 
selected  closer  to  the  mean  could  affect  flight  safety.  As  a "logical"  extension  of  the  realization 
that  all  airplanes  of  a certain  type  cannot  (statistically)  meet  the  design  "economic"  or  fatigue  life 
expectancy,  there  is  a trend  to  develop  exceedance  curves  for  design  that  represent  "average"  rather 
than  "extreme"  environments.  Formerly,  airplanes  were  always  designed  to  the  maximum  expected  or 
extreme  environments  for  both  static  and  fatigue  strength  and  the  static  loads  induced  were  Increased 
by  the  factor  of  safety.  The  affect  of  this  design  trend  on  flight  safety  cannot  be  assessed,  but  the 
Importance  of  selecting  proper  design  parameters  and  having  a factual  data  base  increases. 

The  limitations  which  inhibit  induced  load  measurements  have  led  some  to  believe  that  the  factor 
of  safety  should  be  retained  on  loads,  but  that  all  other  design  considerations  (which  are  assumed  to 
be  well-defined)  should  be  evaluated  by  a rational  statistical  analysis.  These  concepts  might  lead  to 
a refinement  of  current  design  procedures,  but  it  does  not  change  them  since  statistical  considerations 
have  long  been  a part  of  airplane  and  missile  design  criteria.  Although  probability  factors  for  structural 
design  are  seldom  expressed  in  current  criteria,  the  choice  of  limit  load  factors  for  static  and  fatigue 
strength  and  various  environmental  design  parameters  are  fundamentally  based  on  flight  and  environmental 
statistics  (Reference  2A). 

Perhaps  the  most  Important  contribution  to  airframe  safety  is  that  of  testing.  As  so  aptly  noted 
in  Reference  A2,  "safety  regulations,  however  good  and  sophisticated,  should  always  provide  for  approval 
based  upon  relevant  experiment,  such  as  the  measurement  or  control  of  actual  loads,  the  measurement  of 
the  actual  strength  of  components,  and  the  demonstration  of  the  performance  of  the  complete  structure 
by  proof  or  stiffness  teats."  This  practice  has  long  been  the  custom  of  the  aeronautical  engineer. 

Both  ground  and  flight  tests  are  used  to  demonstrate  design  integrity  and  optimize  the  conflicting 
requirements  of  minimum  weight  end  maximum  structural  reliability.  Optimization  and  economic  airframe 
life  requirements  have  in  recent  years  placed  considerable  emphasis  on  developmental  testing.  This 
emphasis  will  probably  Increase  in  future  years.  Although  testing  is  a very  cost  effective  design  and 
substantiation  "tool,"  the  expense  of  testing  is  a major  obstacle  to  obtaining  more  appropriate  statistical 
data  for  reliability-based  design  concepts  and  statistical  substantiation  of  structural  reliability. 

Some  of  the  interacting  roles  of  structural  analysis  and  testing  are  discussed  in  Reference  43. 

A natural  extension  to  current  practice  is  the  use  of  additional  factors  and  design  parameters. 

This  concept  is  less  complex  and  easier  to  manage  in  a rapidly  changing  design  environment  than  using  a 
variable  factor  of  safety.  The  modified  factor  of  safety  concept  (Reference  21)  factors  three  performance 
variables  and  it  could  be  expanded  to  Include  others.  Going  further.  Reference  38  suggested  that  the 
factor  of  safety  on  loads  for  missiles  could  be  reduced  in  certain  instances  when  a particular  load 
source  is  highly  predictable,  thrust  for  example.  However,  Reference  16  expressed  the  view  that  although 
some  design  load  sources  are  highly  predictable,  the  combined  design  load  may  be  exceeded  for  some 
design  conditions  when  components  of  the  combined  load  are  reduced.  In  effect,  known  conservatisms 
compensate  for  the  unknown. 

The  additional  design  complexity  imposed  by  a new  or  revised  concept  on  structural  analysis  must 
be  considered,  too.  Associating  a specific  factor  with  a specific  variable,  regardless  of  the  number 
of  factored  variables,  will  provide  a certain  level  of  additional  complexity  to  a load/stress  analysis; 
using  a variable  factor  of  safety  and  specific  parameters  will  add  a different  level  of  complexity. 
Computerized  analysis  techniques  can  relieve  some  of  the  bookkeeping,  but  considerable  additional 
Judgement  in  design  is  required  as  compared  to  using  a single  factor  of  safety  on  load.  Although  less 
complex,  the  single  factor  of  safety  on  loads  will  not  satisfy  the  objective  to  control  structural 
reliability;  the  single  factor  is  a function  of  numerous  variables  which  can  vary  structural  reliability 
appreciably  and  not  Impose  a change  on  the  factor  itself.  Also,  if  now  factors  of  safety  are  applied 
to  additional  design  parameters  or  if  revised  or  variable  factors  are  applied  to  loads,  the  years  of 
experience  and  back  log  of  compensating  design  limitations  and  related  requirements  which  we  have  for 
the  conventional  factor  of  safety  will  be  lacking  and  design  confidence  will  decrease  until  a new  base 
can  be  established. 

Major  changes  in  airframe  design  technology  are  usually  accompanied  by  a comparison  with  existing 
techniques  prior  to  adoption.  Reference  30  illustrates  a limited  comparison  of  this  type  as  discussed 
in  Section  V.  Other  studies  have  made  comparisons  relating  "equivalent"  factors  of  safety  to  a "compatible 
reliability.  Such  comparisons  can  be  found  in  References  28,  44,  45,  and  46.  There  is  a similarity 
between  reliability  and  factor  of  safety  concepts  which  becomes  more  obvious  when  the  factor  of  safety 
Is  viewed  as  a concept  based  on  the  statistical  definitions  of  many  basic  design  parameters.  Each 
design  parameter,  however,  is  normally  reduced  to  a specific  value  and  the  concept  becomes  deterministic 
rather  than  probabilistic.  To  further  the  analogy,  the  design  (ultimate)  and  operational  (limit) 
stresses  can  each  be  assumed  linear  and  represented  by  a frequency  distribution.  The  ratio  of  the  mean 
stresses  of  each  assumed  distribution  can  then  be  defined  as  a factor  of  safety.  Reference  44  uses 
this  analogy  to  show  that  the  level  of  reliability  can  vary  widely  for  the  same  factor  of  safety  value. 

As  proportional  changes  are  made  to  the  stress  ratio  or  to  the  shape  of  the  distributions,  the  overlap 
of  the  tails  of  the  distributions  varies  and,  in  turn,  the  reliability  varies.  A fixed  factor  of 
safety  cannot,  therefore,  ensure  a constant  level  of  reliability  without  considering  the  statistics  of 
the  design  strength  and  operational  stresses.  Reference  44  further  explains  that  the  factor  of  safety 
can  be  placed  on  a more  rational  basis  and,  in  fact,  only  has  meaning  when  related  to  the  concept  of 
reliability. 

The  degree  of  safety  desired  or  required  also  varies  according  to  the  particular  point  in  the  V-C 
diagram  which  is  involved.  The  left  hand  corners  of  the  diagram  represent  maximum  lift  coefficient  and 
the  maximum  load  possible  (not  considering  the  small  increase  in  maximum  lift  coefficients  that  can 
occur  under  dynamic  conditions  and  which  may  be  used  in  constructing  the  diagram),  and  thus,  if  a 
static  test  has  been  conducted  satisfactorily  and  validated  by  flight  measured  loads,  it  would  be 
physically  'impossible"  to  have  a static  structural  failure  at  these  points  when  operating  normally, 

A similar  statement  may  be  made  of  the  flight  controls,  which  are  limited  in  loading  to  specific  boost 
capacities,  and  in  a mote  general  sense,  to  Inlets  which  are  designed  to  specified  pressures  corresponding 
to  maximum  speeds  to  which  the  airplane  will  fly.  The  airplane  may  physically  exceed  the  design  speed 


(aud  isaneuver  limits),  but  it  has  turned  out  in  practice  that  pilots  have  kept  within  speed  (and  maneuver) 
iimitf  wi*^hout  difficulty.  In  these  cases,  it  might  be  logical  to  consider  a lower  factor  of  safety 
than  that  considered  for  the  right  hand  corners  of  the  V-n  diagram  (Reference  25) . 

Exceptions  to  normally  controlled  flight  conditions  are  instabilities  which  cause  design  load 
factors  to  be  exceeded.  The  factor  of  safety  does  not  recognize  aerodynamic  Instabilities  in  design. 

Even  with  an  extensive  operational  background,  past  experiences  show  that  all  static  flight  failures 
cannot  be  predicted.  Several  "modern"  airplanes  have  been  lost  because  of  unaccounted  for  aeroelastic 
affects.  Some  losses  were  the  result  of  aerodynamic  interactions  and  one  resulted  from  improperly 
predicted  span  wise  wing  loads.  Some  structural  failures  could  have  been  prevented  within  the  state- 
of-the-art  but  others  have  resulted  from  new  phenomena  not  anticipated  or  as  a subsequent  event  to  a 
prior  turbulence  upset  (Reference  25). 

More  recent  examples  of  structural  failure  can  be  cited  for  both  fighter  and  transport  airplanes. 

These  examples  resulted  from  control  system  malfunctions.  Gross  in- flight  structural  failures  subsequently 
occurred  to  the  wings  of  the  airplanes.  Spars  were  cracked  anl  major  thick-akin  wing  planks  became 
detached,  but  the  instabilities  were  eventually  overcome  and  the-  crews  survived.  If  these  structures 
had  been  designed  to  a .lower  factor  of  safety,  or  to  a "design"  load  (rather  than  limit/ultimate) 
concept  having  an  effective  factor  of  safety  lower  than  1.5,  these  airplanes  would  probably  have  failed 
catastrophically  in  flight.  This  failure  projection  is  h}rpothet leal , but  these  real  examples  of  structural 
overload  reflect  the  inherent  conservatism  in  today's  airframe  and  the  need  for  overload  protection. 

It  Is  unlikely  that  the  dollar  value  associated  with  the  cost  of  the  airplane  and  crew  training,  for 
any  one  of  the  several  airplanes  affected,  could  be  off-set  by  the  "savings"  in  weight,  the  performance 
"gained,"  or  operational  costs  "saved"  by  using  a design  concept  that  might  provide  a lower  level  of 
structural  safety. 

There  is  another  measure  of  safety  to  be  accounted  for  beyond  the  "normal"  over-load/under-strength 
probability  limits  of  structural  failure.  Extraneous  causes  of  structural  failure  may  arise  which  are 
not  part  of  an  original  design  evaluation.  Instances  of  poor  maintenance,  improper  assembly  or  reassembly, 
substitution  of  Improperly  heat  treated  components,  etc.,  are  well  know.  Ocher  phenomena  such  as 
hydrogen  embrittlement  and  stress  corrosion  may  not  be  adaptable  to  statistical  design  procedures  and 
the  statistical  limitations  of  small  coupon  or  structural  component  tests  are  also  well  know.  Even  if 
these  events  can  be  statistically  accounted  for,  their  significance  could  overshadow  the  probability  of 
"normal"  structural  failure  when  '/onsidering  reliability-based  criteria  (Ref  25). 

There  is  still  another  safety  aspect  to  consider.  The  factor  of  safety  does  interact  with  other 
design  and  analysis  requirements,  although  it  is  often  viewed  an  independent  measure  of  structural 
safety.  Reference  47  is  a study  of  comparisons  between  existing  and  proposeu  Civil  Engineering  require- 
ments that  emphasize  a similar  Interaction.  The  study  first  notes  the  many  uncertainties  in  design  and 
construction  that  are  covered  by  providing  "overload"  protection.  The  facets  noted  are  identical  in 
context  to  those  considered  within  the  factor  of  safety  concept  for  airframe  design.  Similarly,  the 
factor  of  safety  concept  is  noted  to  be  a crude  method  of  covering  analytical  and  construction  errors, 
but  the  reference  also  notes  that  it  has  the  merit  of  simplicity.  The  study  itself  evaluated  a variety 
of  structures  exposed  to  three  loading  conditions.  It  compared  the  quantities  of  flexural  steel  required 
for  each  design  case  and  assessed  the  theoretical  "overload"  capacities  of  the  structures.  The  steel 
requirements  using  both  the  old  and  new  requirements  were  found  to  be  very  similar  for  each  loading 
condition,  but  the  presumed  overload  protection  was  found  to  vary.  It  was  initially  presumed  and 
implied  in  the  specifications  that  the  theoretical  overload  protection  would  be  proportional  to  the 
factor  of  safety  associated  with  each  load  system.  However,  the  strength  was  not  proportional  to  the 
factors  of  safety  used.  This  occurred  because  the  design  of  the  adjacent  spans  in  the  structure  used 
different  factors  depending  on  whether  they  were  loaded  or  not;  in  some  cases,  the  loaded  spans  were 
couterbalanced  by  an  exaggerated  (factored)  dead  load  on  the  adjacent  unloaded  spans.  The  overload 
capacity  of  the  loaded  spans,  then,  was  not  directly  proportional  to  the  factor  of  safety. 

Even  though  the  study  showed  a variation  in  overload  capacity,  existing  structures  designed  to 
these  requirements  were  still  considered  safe  for  several  reasons;  occurrences  of  actual  overload  were 
negligible,  the  probability  of  understrength  was  low,  and  "inevitable  detailing"  excesses  (design 
conservatism)  existed.  One  additional  reason,  however,  is  most  Important  and  relates  to  the  elastic 
analysis.  Until  recently,  the  complexity  of  the  elastic  analysis  encouraged  the  use  of  simplified 
axisumptions  which  required  up  to  70  percent  more  steel  than  would  have  been  required  by  a more  rigorous 
analysis.  The  additional  material,  in  turn,  greatly  increased  the  overload  capacity  of  the  structure 
and  led  Reference  47  to  conclude  with  this  question:  "With  the  increasing  use  of  computers,  which  make 

more  rigorous  analysis,  will  structures  designed  according  to  (existing  requirements)  or 

similar  types  of  load  systemfs)  still  be  adequately  safe?"  This  question  is  equally  applicable  to  the 
1.5  factor  of  safety  design  concept  for  airplanes. 

The  following  are  similar  points  emphasized  in  Reference  29.  The  main  point  emphasized  is  that 
the  conventional  factor  of  safety  provides  for  (unknown)  situations  that  might  not  be  recognized  in  a 
more  sophisticated  ("rational")  design  procedure.  Any  attempt  to  be  too  sophisticated  can  also  lead  to 
design  procedures  that  are  impractical.  To  avoid  these  possible  problems,  new  and  old  concepts  should 
be  closely  compared.  Any  large  differences  in  the  results  should  be  viewed  with  caution  and  not  be 
accepted  uncritically.  It  Is  further  noted  tliat  different  results,  Cxther  more  or  less  critical,  are 
not  necessarily  adverse  and  can  often  be  justified  under  appropriate  circumstances. 

The  concluding  question  in  Reference  47  should  also  be  expanded  to  reliability-based  concepts:  If 
more  complex  reliability-based  design  concepts  are  eventually  implemented  to  "rationalize"  existing 
requirements,  "save"  airframe  weight  and  "Improve"  performance,  will  the  "new"  structures  still  be 
adequately  safe?  There  is  no  Immediate  answer  available.  Hopefully,  any  change  in  design  concept  will 
bring  with  it  an  adequate  and  equivalent  level  of  airframe  safety;  however,  at./  design  concept  is  a 
balance  of  requirements  involving  numerous  parameters  and  design  .nteractlons  and  any  new  concept 
for  which  experience  is  limited  must  be  thorouglily  evaluated  and  closely  monitored  to  ascertain  the 
true  affect  of  the  change  on  structural  safety. 

Generally,  reliability-based  concepts  are  not  proposed  to  Improve  flight  safety.  Flight  safety  is 
always  a concern  and  new  design  concepts  are  generally  not  adopted  until  an  equivalent  or  better  level 
of  safety  is  assured.  The  most  significant  reason  normally  given  for  adopting  a new  concept  is  to 
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achieve  a reduction  In  weight  when  compared  to  the  accepted  norm.  This  reason  Is  well  Intended  but 
could  also  be  misleading.  The  accepted  norm  can  be  elusive  and  difficult  to  define  and  the  projected 
"savings"  In  structural  weight  can  be  easily  overstated.  Every  design  concept  attempts  to  maximize 
efficiency  and  avoid  either  an  unconservative  or  an  overweight  structure.  In  this  respect,  current 
design  practice  has  been  very  effective.  Reference  19  provides  some  Insight  to  the  history  of  structural 
efficiency  for  bomber  and  transport  airplanes  up  to  1964.  The  observation  Is  that  airplane  weight 
trends  and  structural  weight  fractions  are  very  consistent.  It  makes  no  difference  whether  an  airplane 
Is  Jet  powered  or  propeller  driven,  whether  It  was  built  25  years  ago  or  Is  of  recent  (1964)  vintage. 

There  remains  a balance  between  an  efficient  structure  and/or  material  and  the  design  requirements 
imposed  on  them.  Studies  of  future  airplanes  (beyond  1964)  also  supported  this  trend  (which  still 
seems  valid  today).  It  Is  apparent  that  If  more  efficient  materials  and  types  of  construction  are 
found,  that  more  stringent  operational  requirements  will  be  Imposed  on  them.  Time  and  state-of-the-art 
advances  seemingly  have  little  affect  on  basic  structural  weight  trends.  Reference  19  describes  the 
weight  trend  curves  as  basic,  and  as  such,  a technological  break-through  would  be  required  to  significantly 
change  them. 

The  trends,  of  course,  are  based  on  the  conventional  factor  of  safety  design  and  metallic  materials; 
any  Improvement  In  structural  weight  trends  that  might  result  from  the  use  of  a reliability-based 
design  concept  or  from  composite  materials  when  used  on  an  actual  airplane  Is  unknown.  These  concepts 
may  provide  the  necessary  break-through.  However,  an  airplane  design  Is  the  result  of  many  compromises 
and  interactions  which  have  a neutralizing  influence  on  overall  design  with  respect  to  any  one  parameter. 
Too  often  weight  and  performance  Improvements  are  estimated  superficially  and  the  optimistic  conclusions 
are  not  achievable.  A thorough  study  that  Incorporates  the  major  performance  and  airframe  parameter 
Interactions  In  a design  evaluation  is  required  to  obtain  a confident  weight  Impact  assessment  and  many 
design  variations  would  be  required  to  establish  a new  trend.  The  pacing  Influence  on  performance 
Improvements  to  date  have  come  from  advances  In  propulsion  concepts,  not  structural  concepts.  Structural 
designs  have  successfully  kept  pace,  however,  and  structural  efficiency  has  Improved.  But  as  pointed 
out  In  Reference  19,  when  greater  structural  efficiency  Is  achieved,  greater  demands  are  made  and  the 
structural  weight  fraction  has  not  changed  appreciably. 

The  actual  Impact  of  design  data,  analysis,  weight  and  test  Interactions  on  the  development  and 
application  of  future  reliability-based  concepts  cannot  be  clearly  defined  at  this  time.  The  similarities 
between  the  factor  of  safety  and  probabilistic  tecimiques  Indicate  that  any  state-of-the-art  Improvements 
Intended  to  benefit  the  Implementation  of  a probabilistic  concept  would  also  benefit  and  improve  the 
factor  of  safety  concept.  This  Is  especially  evident  when  considering  a design  data  base  and  may  be  an 
additional  point  to  consider  when  evaluating  changes  in  current  design  concepts. 

There  appears  to  be  a slightly  subdued,  but  continuing  Interest  within  the  aerospace  Industry  to 
develop  a design  concept  that  Improves  the  "deficiencies"  associated  with  the  factor  of  safety  concept. 

It  has  been  assumed  that  any  lack  of  clarity  In  the  merit,  goals  or  direction  that  might  be  associated 
with  a reliability-based  concept,  will  be  resolved  satisfactorily  as  the  concept  is  Implemented, 

The  remaining  section  will  briefly  summarize  the  salient  traits  of  the  concepts  reviewed  and 
project  a possible  balance  in  their  future  application. 


7.  SUMMARY 

To  have  emphasized  "'Iv  ■’tructural  design  concepts  with  respect  to  flight  safety  Is  in  keeping 
with  Che  iutaeded  stepe  or  this  revie-,  but  emphasizing  too  limited  a view  could  be  misleading  and 
detract  from  other  Important  8<>fety  aspect"  Safety  considerations  In  a broader  view  are  discussed  in 
References  48  and  49  and  serve  as  a remin-'*-;  of  the  overall  scope  of  the  safety  problem.  Safety  is  a 
total  operational  system  and  all  aspects  must  be  ooncldercd  In  unison. 

The  static  strength  safety  aspects  of  the  airframe  have  been  "controlled"  primarily  by  the  1.5 
factor  of  safety.  To  be  more  precise,  the  factor  of  safety  has  been  the  most  visible  design  aspect  of 
airframe  safety  and  it  serves  as  a unit  of  measure  In  that  regard.  It  provides  protection  to  occupants 
from  both  understrength  airframes  and  Inadvertent  overloads.  But  the  overell  concept  of  safety  must 
again  be  emphasized  and  not  Just  the  factor  of  safety;  the  factor  does  not  function  alone  but  In  concert 
with  many  other  structural  design  and  operational  requirements. 

The  1,5  factor  of  safety  In  U.S.  design  practice  is  fundamental,  and  represents  a level  of  design 
safety  which  has  become  an  accepted  standard.  Although  the  concept  In  accepted  and  used  without  reserva- 
tion, It  has  remained  In  an  intermittent  state  of  review.  Its  efficiency  ns  a design  concept  has  been 
challenged  and  the  objectives  of  its  design  application  cannot  be  clearly  Identified.  There  are  proponents 
who  have  encouraged  change  and  proponencs  for  the  status  qvio.  To  define  the  arguments  and  differences 
between  them  Is  sometimes  difficult. 

Perhaps  the  1.5  factor  of  safety  Is  "rational"  and  does  not  require  revision.  Or  perhaps  the  1.5 
factor  of  safety  is  "arbitrary"  and  Its  basic  function  cannot  be  defined  sufficiently  to  establish  a 
revised  value.  Its  history  seems  to  say  that  the  1.5  factor  of  safety  is  a mixture  of  both  elements. 

The  1.5  factor  is  "rational"  because  It  Is  based  on  what  were  considered  to  be  representative  ratios  of 
design  to  operating  maneuver  load  factors  evperlenced  during  the  1920s  and  1930s  (which  have  not  appre- 
ciably cir.nged  today)  and  it  le  "arbitrary"  because  we  still  do  not  know  the  exact  design,  manufacturing 
and  operating  unknowns  and  varlt—lons  it  protects  against,  or  how  to  quantify  them.  Neither  can  the 
degree  of  inflight  safety  provided  by  the  1,5  factor  be  quantified,  but  its  successful  history  cannot 
be  lightly  dismissed. 

Reliability  and  realism  seem  to  go  together.  Probabilistic  design  concepts  are  considered  more 
realistic  and  have  been  proposed  aa  being  more  rational  than  the  factor  of  safety.  Reliability-based 
concepts  have,  therefore,  been  proposed  to  replace  the  factor  of  safety  concept.  Because  . J anticipated 
implement.atlon  delays.  Interim  design  techniques  hove  been  proposed  and  consist  of  multiple  factors  of 
safety  which  are  related  to  specific  design  parameters  and  variable  factors  of  safety  which  are  related 
to  specific  design  needs. 

The  primary  Justification  and  final  objective  of  the  probabilistic  concept  Is  to  Improve  airplane 
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performance  and  reduce  operating  costs.  These  improvements  are  to  be  gained  through  reduced  airframe 
weight.  However,  recent  airplane  weight  studies  and  past  weight  trends  have  shown  that  the  actual 
airplane  weight  saved  Is  often  less  than  anticipated.  Durability,  fatigue  life,  and  damage  tolerance 
requirements  also  Influence  airframe  weight  and  tend  to  supersede  savings  gained  through  "improved" 
design  techniques.  These  requirements  add  weight  beyond  that  needed  for  static  strength. 

There  are  many  design  and  operational  (and  possibly  legal)  ramifications  to  be  defined  before  the 
factor  of  safety  concept  can  be  formally  changed  with  assured  justification.  The  lack  of  appropriate 
statistical  data,  the  need  for  procedures  to  establish  the  true  structural  reliability  of  a design  and 
to  demonstrate  (verify)  contractual  requirements  will  also  hinder  Implementation  of  a reliability-based 
design  concept. 

Reliability-based  concepts  are  difficult  to  define  and  understand  In  summary  form  because  of  their 
complexity,  but  regardless  of  the  advantages  or  disadvantages  alluded  to  herein,  the  concepts  cannot  be 
lightly  discarded.  They  must  be  examined  critically  and  objectively,  simultaneously  defining  the 
needed  design  parameters.  Yet,  a completely  rigorous  reliability -based  concept  may  be  so  Impractical 
for  structural  design  that  It  may  be  less  desirable  than  the  easily  administered  (less  rigorous)  factor 
of  safety  concept.  In  time,  the  application  of  reliability-based  concepts  to  airframe  design  will 
increase,  but  the  degree  of  their  application  may  have  a definite  limit.  Future  concepts  will  probably 
evolve  to  incorporate  both  a simplification  of  the  purely  statistical  reliability-based  concept  and  the 
gross  simplicity  of  the  factor  of  safety  concept.  The  factor  of  safety  still  covers  many  contingencies 
and  at  this  time  It  appears  there  will  be  a need  for  some  factor,  and  to  a greater  degree  chan  Is 
sometimes  Implied  (References  21  and  25). 

The  objective  has  not  been  to  support  or  minimize  a particular  structural  design  concept  but  to 
underscore  certain  points  seldom  emphasized.  All  of  the  disadvantages  noted  apply  to  both  the  factor 
of  safety  and  reliability-based  concepts.  The  point  is,  that  the  reliability-based  concept  will  not 
eliminate  all  of  the  "problems"  of  the  factor  of  safety  concept  or  necessarily  offer  a "safer"  design. 
In  fact,  the  "problems"  may  tend  to  Increase  because  of  limited  design  experience  with  statistical 
concepts  and  the  use  of  statistically  "defined"  parameters  that  may  be  of  questionable  validity. 
Furthermore,  there  may  be  an  unjustified  confidence  in  computed  reliability  estimates,  although  relia- 
bility-based design  concepts  have  been  assumed  to  be  mote  rational  than  factor  of  safety  concepts.  The 
physical  results  of  a reliability-based  design  and  the  related  statistical  data  lust  be  more  than  a 
mathematical  nicety;  the  statistical  confidence  expressed  in  the  design  must  be  realizable.  In  fact. 
Finally,  regardless  of  the  design  concept  adopted  for  future  use,  the  safety  of  the  airframe  will 
depend  not  only  on  that  concept,  but  on  the  adequacy  of  Che  total  structural  design  criteria  and  Che 
ability  of  the  concept  to  meet  the  proof  of  compliance  requirements  of  Che  design  specifications 
(Reference  25) . 
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Figure  2.  Army  Navy  Commerce  (ANC)  Committee  Programs  and  Publications  (Reference  2a) 


Figure  3.  Navy  V-G  Diagram.  Log-Log  Coordinates  and  Rounded  Corners  (Reference  2c) 
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Figure  4.  Specification  X-1803  Claasifications  (Reference  2c) 
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Figure  5.  Structural  Weight  and  Margin  of  Safety  Variations  vrtth  Changes  in  Factor  of  Safety 


Figure  6.  Example  of  Interaction  Envelope  Construction  (Reference  20) 
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Figure  7.  Structural  Limitations  Large  Cruise  Vehicle  (Reference  20) 
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THE  LABORATORIO  NACIONAL  DE  ENGENHARIA  CIVIL 
AND  THE  STRUCTURAL  SAFETY  CONCEPTS 
IN  CIVIL  ENGINEERING 


by 

J. Ferry  Borges 

Director,  Laboratdrio  Nacional  de  Engenharia  Civil, 
Lisbon,  Portugal 


1.  INTRODUCTION 

This  opening  presentation  is  divided  into  two  completely  different  subjects. 

First  a brief  description  of  the  Laboratono  Nacional  de  Engenharia  Civil  (Portuguese  Civil  Engineering  Laboratory) 
LNEC. 

Tliereafter  a sumn.ary  of  the  present  situation  concerning  structural  safety  concepts  in  Civil  Engineering. 

The  descnption  of  LNEC  is  justified  by  the  fact  that  the  AGARD  meeting  is  taking  place  in  its  campus. 

The  presentation  of  structural  safety  concepts  is  justified  by  the  possible  mutual  benefits  that  can  deri  e from  a 
comparison  of  structural  safety  concepts  used  in  Aeronautics  and  Civil  Engineering. 


2.  THE  PORTUGUESE  CIVIL  ENGINEERING  LABORATORY.  LNEC 

The  LaboratOno  Nacional  de  Engenharia  Civil,  LNEC,  is  a research  institute  in  tlie  domain  of  construction  related 
to  Civil  Lngmeenng.  It  gives  technical  support  to  the  activity  in  the  following  fields,  building  and  town  plcnning 
thousing,  schools,  social  equipment),  transportation  (roads,  railways,  harbours  and  airports),  power  production  (hydro 
electric,  thermic  and  nuclear  plants,  overhead  electric  lines),  industrial  and  agricultural  buildings,  building  materials, 
elements  and  components;  design  and  construction. 

It  depends  on  the  minister  of  Public  Works  direct,  and  is  in  close  contact  with  the  remaining  slate  departments,  and 
public  and  private  enterpnses  concerned  with  the  above  fields.  As  it  also  carries  out  specialization  and  professional  up- 
grading activities,  it  keeps  in  touch  with  institutions  mainly  devoted  to  education. 

LNEC,  with  Its  staff  of  about  1 ,000,  of  which  more  than  two  hundred  are  graduated  people,  may  be  considered  an 
important  research  institution  not  only  on  national  level  but  also  by  international  standards. 

Perseverance  in  training,  improving  and  selecting  its  staff  for  about  thirty  years  has  made  it  possible  to  assemble  a 
group  of  researchers,  specialists,  assistants  and  other  technicians  and  administutive  personnel  who  form  a valuable  patr 
mony . In  the  neai  future  there  is  the  purpose  of  enlarging  the  specialized  technical  staff  in  such  a way  as  lo  increase 
LNEC  capacity  to  meet  Portugal's  needs  for  research  and  to  continue  collaborating  in  the  resolution  of  problems  put  by 
foreign  organizations. 

LNEC  is  organized  into  8 departments  and  38  technical  or  administrative  divisions. 

The  total  operation  cost  of  LNEC  in  1977  amounted  to  about  300  million  esoudos,  of  which  about  one  third  corres- 
ponds to  state  appropnation,  one  tnird  is  granted  from  investment  plans  to  research  and  one  third  corresponds  to 
contracted  studies  and  services. 

The  LNEC  campus  is  about  22  hectares.  Its  total  floor  area  is  about  70,000  n * . 

To  give  support  to  research  activities,  LNEC  has  a computing  centre,  which  is  also  used  by  a large  number  of  public 
and  private  organizations  on  a time-sharing  basis. 

It  also  has  some  design  offices  and  workshops  for  developing  mechanical  and  elet.troni<.  test  equipment  not  available 
on  the  market.  Some  of  that  equipment  has  been  patented,  and  is  commetcialized  by  LNEC  niair  .y  abroad. 


To  back  up  research,  LNEC  is  provided  with  a library  which  contains  about  100,000  publications  and  receives  more 
than  800  penodicals.  The  library  warding  index  contains  above  600,000  entries.  Automation  of  bibliographic  research  is 
already  a fact  for  some  domains  (roads,  hydraulics),  and  it  will  progressively  be  extended  to  further  domains. 

Research  is  conducted  following  four-years  plans  that  obey  guide-lines  set  for  longer  times,  and  are  put  to  effect  by 
means  of  yearly  plans.  Four  research  plans  are  in  progress,  a government  s investment  plan  that  gives  support  to  building 
research,  a pian  for  housing  studies,  a plan  for  hydraulic  studies,  and  a plan  for  studies  on  roads,  railways  and  airfields,  all 
provided  with  their  own  funds.  All  such  planning  is  carried  out  in  coordination  with  bodies  concerned  with  activities  in 
these  fields.  Tlie  total  number  of  studies  included  in  these  plans  amounts  to  about  two  hundred. 

Researcn  applied  to  resolution  of  specific  problems  related  to  design  and  construction  of  civil  engineering  works  is 
made  on  contract.  Planning  and  budgeting  precede  every  study.  As  studies  progress  the  control  of  their  execution  and 
cost  is  carried  out. 

In  addition  to  research,  LNEC  carries  out  a large  number  of  other  activities,  such  as.  standard  tests,  drafting  of 
specifications,  standards  and  codes,  delivering  of  agreements  and  classification  of  building  materials  and  components, 
control  of  matenals  production,  observation  of  structural  behaviour,  general  information  and  advice. 

Particular  reference  should  be  made  to  specialization  and  professional  upgrading  activities  under  the  form  of 
seminars,  courses  and  technical  information  sessions. 

Tire  seminars  are  mainly  meant  for  updating  and  discussing  knowledge  on  specialized  subjects.  They  disseminate 
research  activities  and  contnbute  towards  the  training  of  LNEC  specialists  as  well  as  other  technicians  particularly  of 
holders  of  study  grants  working  at  LNEC.  The  training  of  specialists  is  extended  to  non-LNEC  trainees  who  by  completing 
a study  programme  and  submitting  a thesis  can  qualify  as  research  officers  and  principal  research  officers. 

Professional  upgradmg  couises,  held  in  Lisbon  and  in  several  other  towns  in  Portugal,  are  meant  for  the  professional 
upgrading  of  technicians  concerned  with  the  building  industry. 

Technical  information  sessions  have  the  purpose  of  divulging  recent  achievements  in  different  domains. 

The  dissemination  of  knowledge  is  backed  up  by  the  publication  of  numerous  documents,  technical  papers, 
techni  lal  infomiation  sheets,  manuals,  text-books,  specifications  and  booklets  of  several  kinds. 

A general  assessment  of  its  action  since  it  v.as  created  in  1947  makes  it  clear  that  the  LNEC  has  succeeded  in 
achicvmg  the  goals  that  were  set  to  it.  In  addition  to  contributing  towards  progress  of  knowledge  in  several  domains,  it 
has  solved  a large  number  of  problems  put  to  it  either  by  national  or  foreign  organizations,  and  moreoevet  it  has  conducted 
many  other  ai^tions  for  the  benefit  of  the  Port  jguese  te^-hnology  with  the  aim  of  contributing  to  the  social  and  economic 
progress  of  the  country. 


3.  STRUCTURAL  SAFETY  CONCEPTS  IN  CIVIL  ENGINEERING 

3.1  The  Activity  of  the  Joint-Committee  on  Structural  Safety 

The  improvement  and  implementation  of  struotural  safety  concepts  is  the  basic  aim  of  the  JointGomniittee  created 
in  1971  and  sponsored  by  the  following  international  associations  in  Civil  Engineering.  CEB  Euro-International 
Committee  for  Concrete,  CECM  - European  Convention  tor  Constructional  Steelwork.  CIB  International  Council  for 
Building  Research  Studies  and  Documrntation,  FP  International  Federation  for  Prestressing,  lABSE  International 
Association  for  Bridge  and  Structural  Engineering,  and  RILEM  International  Union  of  Testing  and  Research  Laboratories 
for  Materials  and  Structures. 

Several  international  bodies  such  as.  ECE  Economic  Commission  for  Europe  of  the  United  Nations  Economic  and 
Social  Council,  CEL  iCommon-MarkcU  Commission  of  European  Communities  and  ISO  International  Organization  for 
Standardization  are  working  in  the  hariiionization  of  iniernational  rules  for  the  design  and  execution  of  structures  for 
different  types  of  construction  and  material.  This  harmonization  implies  unification  of  basic  concepts. 

The  improvement  and  unification  of  basic  concepts  are  upstream  of  the  harmonization  of  .spcvifiv  rules.  Consequently 
the  terms  of  reference  of  the  Joint-Committee  are  of  great  importance. 

.An  extended  unification  of  <,onccpts  and  design  rules  should  allow  mankind  to  benefit  from  existing  knowledge 
collected  through  irucmation.il  cooperative  work.  However,  the  fixing  of  concepts  hinders  progress.  This  duality  has 
been  considered  and  steps  have  oecn  taken  to  try  to  maximize  the  advantages  of  world  wide  cooperation,  and  to  minimize 
the  disadvantages  of  crystallization  and  possible  obsolescence  of  fundamental  concepts. 

Due  to  the  initiative  of  CEB,  a sec  of  common  unified  rules  for  different  types  of  construction  and  material  is  beiiig 
drafted'  *.  Sub-committeei,  were  created  wilhm  the  Joint Gommittee  to  deal  with  the  first  volume  of  this  set  of  unified 


rules.  This  volume  covers,  objectives  and  general  recommendations  for  design,  design  methods,  basis  for  the  deter 
mination  of  actions  and  their  combinations,  general  conditions  for  use,  control  and  acceptance  of  materials  and 
components. 
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A bnef  summary  of  the  problems  discussed,  of  the  solutions  adopted  and  of  the  progress  expected  is  presented.  It  is 
not  possible  to  review  the  overall  activity  of  the  Joint-Committee.  Since  its  creation  and  up  to  the  end  of  1976,  the 
Committee  had  eight  plenary  meetings  m which  more  than  60  contributions  were  presented’ . The  activity  of  the  Editorial 
Group,  chaired  by  R.E.Rowe.  who  drafted  the  main  text  of  Volume  I,  and  of  the  Sub  committees,  chaired  by  R.Rackwitz, 
who  drafted  the  Appendix  dealing  with  Level  2 and  the  set  of  studies  on  First  Order  Reliability  Concept  for  Design  Codes'* 
is  particularly  acknowledged. 

3.2  Design  Objectives 

The  perspective  of  design  as  a decision  process  is  well  established.  The  ranking  of  objective  functions  in.  utility,  cost 
and  reliability,  is  dear.  For  tune  invariant  problems  general  theoretical  formulationc  conceptually  correct  already  exist* 

Tile  reliability  concept  of  achievement  of  acceptable  probabilities  that  structures  will  not  become  unfit  is  ready  :o  be 
used  m much  broader  terms  than  till  now.  This  is  not  the  case  with  utility  or  generalised  cost.  These  important  basic 
concepts  would  need  further  supporting  data  m order  to  be  implemented.  However,  ihe  choice  of  the  acceptable 
probabilities  (or  reliability  mdicesj  can  be  guided  by  the  aim  of  maximizing  utility  or  minimizing  generalized  cost.  This 
leads  to  the  consideration  of  cost  of  failure  consequences  and  attenuation  cost  (increase  of  initial  cost  per  unir  of  increase 
of  reliability). 

3.3  Limit  States 

The  concept  of  limit  state  corresponds  to  a discretization  of  the  concept  of  utility.  Given  e.g.  a structural  element 
acted  on  by  an  action-effect  S of  components  M (bending  moment)  and  N (axial  force)  there  is  a domain  of  structural 
behaviour  withm  whidi  the  utihty  is  positive,  a region  in  which  utility  rapidly  decreases  and  another  domain  where  utility 
becomes  .strongly  negative. 

Tlic  region  between  the  positive  and  the  negative  domains  can  be  idealized  as  a border  which  limits  a safe  domain 
This  border  corresponds  to  a limit  state.  Often  the  utility  surface  is  ondiilated  and  several  types  of  limit  states  can  be 
defined  which  correspond  to  different  borders,  each  one  associated  with  a given  type  of  behaviour  (cracking,  deflection, 
failure). 

Tlus  way  of  thinking  is  satisfactory  for  time-invariant  problems.  However,  this  is  not  the  general  case.  The  negative 
utihty  associated  to  a limit  state  depends  on  the  interval  of  time  during  which  the  considered  behaviour  (unfitness)  is 
attained. 

Limit  states  are  usually  classified  into  two  groups,  ultimate  and  serviceability  limit  states.  The  single  occurrence  of 
an  ultimate  limit  state  produces  an  abrupt  reduction  of  utility.  In  serviceability  limit  states  the  reduction  of  utility  is  in 
general  small  and  depends  on  the  time  interval  during  which  the  limit  state  is  surpassed. 

This  duration  concept  is  included  in  the  unified  code' . Actions  are  defined  in  such  a way  that  the  durations  of 
exceedence  of  given  values  can  be  easily  determined. 

For  given  matenals  (e.g.  concrete  and  timber)  the  duration  of  the  actions  affects  not  only  the  serviceability  limit 
states  but  also  general  structural  behaviour.  Although  the  idealization  of  actions  should  allow  their  definition  for  any 
interval  of  time  a standardization  is  advisable.  At  present  there  is  the  tendency  to  consider  two  durations  quasi 
permanent  and  frequent  actions' . The  first  corresponding  to  mean  values  in  the  probability  distributions  of  instantaneous 
values  tas  sampled  distnbutionsj  and  the  second  to  the  upper  5X  fractiles  of  these  distributions.  In  special  cases  other 
values  have  to  be  considered* . 

riie  need  to  include  m the  unified  code  the  definition  of  a reference  time  derives  from  the  fact  that  probabilities  due 
to  single  events  (construction  phase)  have  to  be  associated  to  probabilities  of  extreme  values  due  to  multiple  events 
(.variable  actions).  Tlie  probabilities  of  multiple  events  have  to  be  referred  to  an  interval  of  time.  The  interval  of  time  of 
50  years  is  now  accepted  as  standard.  However  the  theoretical  formulatiois  and  the  basic  data  easiiy  allow  to  compute 
probabilities  given  any  other  value  of  the  reference  time. 

3.4  Levels  of  Design 

The  introduction  of  the  concept  of  levels  of  design’  derived  from  tlie  need  to  classify  different  more  or  less 
approximate  computational  procedures,  leading  to  the  fulfilment  of  design  objectives. 

Three  design  levels  are  considered.  Level  3 is  a fully  probabilistic  method.  Design  decisions  are  based  on  the  expected 
value  of  the  utility  E(V)  or  on  the  probability  of  attaining  a limit  state.  Pf. 
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For  time-invariant  problems,  given  a set  of  basic  variables  X , the  expected  value  of  the  utility  is  given  by. 


E(V)  = / Vx(x)dFx(x) 
■'R  “ ~ 


(1) 


where  Fxtx)  are  the  probability  distributions  of  the  basic  variables,  and  Vx(x)  measures  the  utility  associated  to  them. 
Tlie  integral  { 1 ) is  extended  to  the  space  R of  all  variables  X . 

Tlie  notions  of  safe  and  unsafe  regions  result  from  substituting  the  concept  of  limit  state  to  the  concept  of  utility. 

The  probability  of  surpassing  a given  limit  state,  which  corresponds  to  the  probability  of  being  outside  the  safe  region  Dx  , 
is  given  by  the  integral 


Pf  = 1 - /■  d Fx  (X) 
•'Dx 


(2) 


All  methods  which  allow  an  exact  computation  of  the  integral  (1)  or  (2)  are  classified  in  Level  3. 

Level  2 is  an  approximate  probabilistic  method. 

Let  the  bolder  of  the  safe  domain  D;c  be  defined  by  a function  g(X  , »»)  = 0 where  is  a design  parameter.  One 
way  of  approximately  assessing  the  reliability  consists  in  measuring  the  distance  between  the  mean  value  X and  the  border 

g(X  , R)  = 0 (3) 

Assume  that  the  basic  variables  are  independent  and  introduce  the  reduced  basic  variables 

. . iCi  ,4, 

"X, 


Equation  (3)  becomes 


g(j;,i>)  = 0 

The  reliability  which  corresponds  to  a given  value  of  i>  is  measured  by  the  reliability  index  /5 . The  relationship 
between  and  v is  expressed  by  the  set  of  equations 

yf  = ±q(3  (5) 
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etyl  ..-..yn  .")  = 0 

Tlie  derivatives  included  in  equation  (6)  are  computed  at  the  design  point  j;*  . 

Tlie  system  of  equations  (5;  to  (7)  can  be  solved  by  iterative  procedures. 

Point  y*  is  a distance  ^ from  the  origin,  closest  to  it  on  surface  g(y  . n)  = 0 . 

Points  yf  arc  fractiles  weiglited  by  parameters  Oj , (8)  and  correspond  to  Xj  = Xj  ± cq  0 Ox , . 

Level  1 is  the  so  called  semi-probabilistic  method. 

At  Level  1 fixed  fractiles  of  the  basic  variables  are  used.  Tlicsc  fractiles  tdiaractenstic  values)  are  multiplied  by  partial 
safety  factors  which  do  not  depend  directly  on  the  limit  state  criterion  expressed  by  gtX , n)  = 0 . 

Briefly,  the  algorithms  used  at  Level  3 allow  to  compute  awurately  the  values  of  the  objective  functions,  at  Level  2 
the  algoiithms  yield  approximate  values  of  the  extremes  of  the  design  functions,  at  Level  1 these  approximate  extremes 
are  obtained  by  introducing  extremes  of  the  basic  variables  in  deterministic  design  functions. 

In  Levels  3 and  2 the  basic  vanablcs  are  expressed  by  their  probability  distributions  or  at  Level  2 by  their  two  first 
moments,  mean  and  variance.  In  Level  1 basic  variables  are  expressed  by  fixed  fractiles. 


Die  classifiLation  in  tlirce  design  levels  is  arbitrary  and  ineomplete.  Levels  higlier  than  Level  3 could  be  introduced 
lo  express  optimization  criteria’  or  to  include  prediction  decision  theoues' . Also,  there  are  no  definite  borders  between 
different  levels.  For  instance,  the  partial  safety  factors  to  be  used  at  Level  I can  be  denved  from  computations  at  Level  2. 

3.5  Operating  Spaces 

For  an  understanding  of  code  alternatives  for  safety  checking,  the  concept  of  operating  spaces  should  be  introduced' . 

The  basic  variables,  X , (actions,  material  properties,  dimensions,  etc.)  define  the  input  space. 

Limit  state  conditions  are  usually  expressed  in  action-effects,  displacements,  crack  widths.  Tlie  space  of  these 
variables  is  called  output  space. 

For  some  problems  it  is  convenie.nt  to  introduce  auxiliary  vanables  (e.g.  strains,  stresses)  which  define  the  state -space. 

Direct  design  or  safety  checking  can  be  earned  cUt  at  any  of  these  spaces.  However  non-linear  transformations 
between  spaces  art  usually  necessary . F or  safety  checking  in  the  input  space  a transformation  into  basic  vanables  of  liir.it 
state  conditions  is  needed,  the  same  checking  in  the  output  space  implies  a transformation  of  the  basic  variable  into  this 
space.  Finally,  in  the  state-space,  both  basic  variable  and  limit  state  conditions  are  to  be  transformed. 

Usually  at  Level  1,  utlimate  limit  stales  checking  is  earned  out  in  the  output  space  by  companng  resisting  and  acting 
action-effects.  Tins  corresponds  to  a special  format  of  g(X  , v)  < 0 of  the  type  S(X,  ...  Xp  — R(Xj+  ] . . . X^)  < 0 
where  S(.)  can  be  identified  as  acting  action-effects  and  R(.)  as  resisting  action-effects. 

The  mentioned  formulation  spaces  can  be  used  in  any  type  of  structural  analysis  (linear,  non  linear,  plastic)  and  of 
design  levels.  Their  choice  depends  on  operational  motives. 

3.6  Basic  Variables 

3.6.1  Actions 

For  many  decades  man  has  been  spending  much  activity  in  the  measurement  of  actions.  However,  it  is  only  recently 
that  these  results  are  being  interpreted  under  a common  methodology  in  order  to  be  used  in  design. 

As  indicated,  the  probabilistic  fonnulation  of  safety  implies  a probabilistic  definition  of  the  actions.  Consequently, 
available  data  have  to  be  interpreted  statistically  in  order  to  obtain  convenient  definitions. 

The  Joint-Committee  has  made  a considerable  effort  to  idealize  the  most  important  types  of  actions’®  Several  inter 
national  associations  and  several  groups  in  different  countries  are  working  in  the  same  direction. 

Levels  2 and  3 can  only  be  implemented  if  probabilistic  idealizations  of  actions  are  given.  For  variable  actions  these 
idealizations  should  include  not  only  instantaneous  values  but  also  extren.e  values  for  different  intervals  of  time.  Con 
sequently,  the  idealizations  have  to  be  based  on  stochastic  processes.  The  simplest  stochastic  process  model  which  allows 
the  combination  of  variable  actions  is  of  the  repeated  independent  event  type"  . Using  this  simple  model  all  the  pertinent 
probability  distributions  of  the  parameters  definirit  he  actions  can  be  derived  from  the  distribution  of  extreme  values  in 
the  reference  time  and  from  the  corresponding  number  of  repetitions'® . 

Progress  in  the  definition  of  actions  is  expected  to  derive  not  only  from  the  use  of  stochastic  models,  more  refined 
than  this  one,  but  particularly  from  improved  prediction  decision  rules,  allowing  to  build  piagmatically  optimal  models' , 
and  also  from  the  consideration  that  several  types  of  actions  are  man-produccd  or  man  ontrolled. 

3 6.2  Mechanical  Properties 

Th-.  relatiunsh.p  between  control  and  definitiun  of  mechanical  properties  should  be  very  intimate.  Eftorts  along  these 
lines  yielded  an  improved  definition  of  types  of  control  and  acceptance  rules'* . Progress  depends  not  only  on  better 
theoretical  apptoache.s  which  allow  to  incorporate  all  information  avudable  in  the  probabilistic  definition  of  mechanical 
pioperties,  but  also  on  improved  cooperation  with  the  industries  of  materials  of  constniction  to  compaLbilizc  the  needs 
and  interests  of  the  owners,  the  designers,  the  builders  and  the  producers  of  materials.  Mutual  infomiation  and  national 
and  international  actions  are  required. 

3 6.3  Dimensions 

Dimensional  tolerances  are  often  viewed  as  a constructional  and  not  as  a staictural  problem.  For  structural  purposes 
dimensions  are  usually  taken  as  deterministic  viuantitics.  When  the  probabilistic  vaiiability  lias  to  be  considered,  the 
present  tendency  consists  in  extending  to  structural  problems  the  cormept  of  tolerances  and  assigning  upper  and  lower 
limits  of  the  dimensions  to  be  introduced  in  structural  design  exprc‘ssions. 


In  future,  dimensions  should  be  dealt  with  as  other  basic  variables  by  defining  their  probability  distributions  and 
by  fixing  control  and  acceptance  rules  to  fulfil  both  constructional  and  structural  objectives. 

3.7  Combination  of  Actions 

Given  a vanable  X of  probability  distribution  F(X> , the  probability  distribution  of  the  extreme  values  obtained 
by  r independent  repetitions  of  X is  expressed  by 

Fr(X)  - (F(X))f  (8) 

Hus  simple  expression  allows  to  transform  distributions  of  instantaneous  values  into  extreme  distributions  for  any 
value  of  r (the  r repetitions  being  assumed  to  correspond  to  non-correlated  trials). 

If  n different  types  of  actions  act  simultaneously,  design  should  be  checked  for  n combinations  of  actions  each 
one  corresponding  to  tiie  case  in  which  one  of  the  actions  assumes  its  extreme  value  in  the  reference  time.  The 
computation  procedure  is  the  following: 

The  n actions  are  ordered  according  to  tlieir  number  of  repetitions,  q < rj+ 1 . 

The  probability  distnbutions  to  be  used  in  each  combination  are  obtained  assuming  the  number  of  repetitions 
indicated  in  Table  1’. 


TABLE  I 


Number  of  Repetitions  to  be  Considered  in  Each  Combination 


Combination 

Number 

Action  number  and  number  of  repetitions 
in  the  reference  time 
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2 
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rn/^n-l 
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. . . 

Tn/rn-l 
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fn/fn-l 
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1 

1 

1 

. s . 

fn 

When  used  at  Level  1 this  combination  rule  corresponds  to  reducing  the  characteristic  values  of  the  actions.  In  the 
Unified  Code  this  reduction  IS  introduced  through  a combination  factor,  . In  the  same  way,  coefficients  and  ipi 
arc  introduced  to  transform  extreme  characteristic  actions  in  tlie  reference  time  into  actions  with  different  durations. 

Ttie  combination  rules  which  include  actions  of  different  durations  are  also  included  in  the  Unified  Code. 

3.8  Structural  Behaviour 

111  the  optics  of  safety  decking  tlie  study  of  structural  behaviour  consists  in  the  transformation  of  variables  between 
operating  spaces.  In  general  the  transformations  arc  non-linear. 

fhe  simultaneous  transfonnation  of  aii  vanables  from  the  input  to  the  output  space  or  reciprocally  is  in  most  cases 
difficult  to  handle.  For  this  reason  it  is  convenient  to  split  the  problems  i.ito  (i)  transformations  which  allow  to  determine 
the  limit  state  surface  ^resisting  actiun-effectsj  in  the  action -effects  space  (members  analysis)  and  (ii)  transformations 
which  allow  to  obtain  the  action-effects  acting  on  the  members  as  a function  of  the  combined  actions  (structural  analy  sis) 

This  corresponds  to  a formulation  of  the  type  S - R , in  the  gencialkcd  sense  of  considering  the  multidimensional 
character  of  S and  R and  consciiuently  defining  the  space  variability  of  S and  the  safe  domain  of  action  effects  limited 
by  R . In  this  formulation  the  border  of  the  safe  domain  is  no  longer  deterministic  but  random.  It  can  be  determined 
using  the  weighted  fractilcs  method. 

Tlie  probabilistic  vanability  of  the  acting  action-effects  has  to  be  derived  from  the  variability  of  the  actions  taking 
m due  consideration  the  non-Iincanty  of  the  iransformutton  S(X) . Also,  in  tills  case  a linearization  procedure  should  be 
adopted. 

At  Level  2 it  would  be  convenient  to  implement  algorithms  which  would  allow  the  combination  of  tlie  two  problems 
and  consequently  a unified  linearization  and  definition  of  weighted  fractiles. 


In  future,  dimensions  should  be  dealt  with  as  other  basic  variables  by  defining  their  probability  distributions  and 
by  fixing  control  and  acceptance  rules  to  fulfil  both  constructional  and  structural  objectives. 

3.7  Combination  of  Actions 

Given  a vanable  X of  probability  distribution  F(X) , the  probability  distribution  of  the  extreme  values  obtained 
by  r independent  repetitions  of  X is  expressed  by 

F,(X)  = (F(X))r  (8) 

This  simple  expression  allows  to  transform  distributions  of  instantaneous  values  into  extreme  distributions  for  any 
value  of  r (the  r repetitions  being  assumed  to  correspond  to  non-correlated  trials). 

If  n different  types  of  actions  act  simultaneously,  design  should  be  checked  for  n combinations  of  actions  each 
one  corresponding  to  the  case  in  which  one  of  the  actions  assumes  its  extreme  value  in  the  reference  time.  The 
computation  procedure  is  the  following: 

The  n actions  are  ordered  according  to  tlieir  number  of  repetitions,  rj  < rj+  j . 

The  probability  distnbutions  to  be  used  in  each  combination  are  obtained  assuming  the  number  of  repetitions 
indicated  in  Table  I ’ . 


TABLE  I 


Number  of  Repetitions  to  be  Considered  in  Each  Combination 


Combination 
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Action  number  and  number  of  repetitions 
in  the  reference  time 
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When  used  at  Level  1 this  combination  rule  corresponds  to  reducing  the  characteristic  values  of  the  acLons.  In  the 
Unified  Code  this  reduction  IS  introduced  through  a combination  factor,  . In  the  same  way,  coefficients  and 
are  introduced  to  transform  extreme  characteristic  actions  in  tlie  reference  time  into  actions  with  different  durations. 

Tlie  combination  rules  which  include  actions  of  different  durations  are  also  included  in  the  Unified  Code. 

3.8  Structural  Behaviour 

In  the  optics  of  safety  checking  the  study  of  structural  behaviour  consists  in  the  transformation  of  variables  between 
operating  spaces.  In  general  the  transformations  arc  nouTinear. 

The  simultaneous  transfonnation  of  ah  v enables  from  the  input  to  the  output  space  or  reciprocally  is  in  most  cases 
difficult  to  handle.  For  this  reason  it  is  convenient  to  split  the  problems  i.ito  (i)  transformations  which  allow  to  detennine 
the  limit  state  surface  trcsisting  action-effects)  in  the  action -effects  space  (members  analysis)  and  (ii)  transformations 
which  allow  to  obtain  the  action-effects  acting  on  the  members  as  a function  of  the  combined  actions  (structural  analysis). 

Tins  corresponds  to  a formulation  of  the  type  S - R , in  the  geneialucd  sense  of  considering  the  multidimensional 
character  of  S and  R and  conseiiuently  defining  the  space  vanability  of  S and  the  safe  domain  of  action  effects  limited 
by  R . In  this  formulation  the  border  of  the  safe  domain  is  no  lunger  deterministic  but  random.  It  can  be  determined 
using  the  weighted  fractilcs  method. 

The  probabilistic  vanability  of  tlie  acting  action-effects  has  to  be  derived  from  the  variability  of  the  actions  taking 
in  due  consideration  the  non-lmcanty  of  the  transformation  S(X) . Alsu,  in  tills  case  a linearizailon  procedure  should  be 
adopted. 

At  Level  2 it  would  be  convenient  to  implement  algorithms  which  would  allow  the  combination  of  tlie  two  problems 
and  consequently  a unified  linearization  and  definition  of  weighted  fractiles. 
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